Traefik结合Certbot在OVH环境下无法生成证书的问题排查请求

问题背景 #

在Docker中部署Portainer后，创建了集成Certbot的Traefik Stack，已在OVH获取Certbot API密钥，目标是生成域名通配符证书，但开启DEBUG日志后出现证书获取失败错误。

Docker Compose配置 #

version: "3.8"

volumes:
  trafeik_crt:

networks:
  frontend_proxy:
    driver: bridge
    enable_ipv6: false
    ipam:
      driver: default
      config:
        - subnet: 172.20.5.0/26

services:

  traefik:
    container_name: Traefik
    image: traefik:latest
    environment:
      TRAEFIK_LOG_LEVEL: 'DEBUG'
      TRAEFIK_GLOBAL_CHECKNEWVERSION: 'true'
      TRAEFIK_PROVIDERS_DOCKER: 'true'
      TRAEFIK_PROVIDERS_DOCKER_EXPOSEDBYDEFAULT: 'true'
      TRAEFIK_API: 'true'
      TRAEFIK_API_DASHBOARD: 'true'
      TRAEFIK_API_INSECURE: 'true'
      OVH_ENDPOINT: 'ovh-eu'
      OVH_APPLICATION_KEY: 'my_app_key'
      OVH_APPLICATION_SECRET: 'my_secret'
      OVH_CONSUMER_KEY: 'my_cons_key'
      TRAEFIK_CERTIFICATESRESOLVERS_certbot: 'true'
      TRAEFIK_CERTIFICATESRESOLVERS_certbot_ACME_DNSCHALLENGE: 'true'
      TRAEFIK_CERTIFICATESRESOLVERS_certbot_ACME_DNSCHALLENGE_PROVIDER: 'ovh'
#      TRAEFIK_CERTIFICATESRESOLVERS_certbot_ACME_CASERVER: 'ttps://acme-v02.api.letsencrypt.org/directory'
      TRAEFIK_CERTIFICATESRESOLVERS_certbot_ACME_EMAIL: 'info@mydomain.com'
      TRAEFIK_CERTIFICATESRESOLVERS_certbot_ACME_STORAGE: '/letsencrypt/acme.json'
      TRAEFIK_ENTRYPOINTS_web: 'true'
      TRAEFIK_ENTRYPOINTS_webs: 'true'
      TRAEFIK_ENTRYPOINTS_web_ADDRESS: ':80'
      TRAEFIK_ENTRYPOINTS_webs_ADDRESS: ':443'
      TRAEFIK_ENTRYPOINTS_web_HTTP_REDIRECTIONS_ENTRYPOINT_TO: 'webs'
      TRAEFIK_ENTRYPOINTS_web_HTTP_REDIRECTIONS_ENTRYPOINT_PERMANENT: 'true'
      TRAEFIK_ENTRYPOINTS_web_HTTP_REDIRECTIONS_ENTRYPOINT_SCHEME: 'https'
      
    hostname:
      srv_traefik1
    ports:
      - 8051:80/tcp # Trafeik HTTP
      - 8052:8080/tcp # Trafeik WebUI
      - 4351:443/tcp # Trafeik HTTPS
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - trafeik_crt:/letsencrypt
    networks:
      frontend_proxy:
        ipv4_address: 172.20.5.2
    dns:
      - 172.16.25.1;

错误日志 #

level=debug msg="Creating load-balancer" entryPointName=web serviceName=httpd-httpd-main routerName=httpd_main@docker
level=debug msg="Creating server 0 http://172.20.5.3:80" entryPointName=web serviceName=httpd-httpd-main serverName=0 routerName=httpd_main@docker
level=debug msg="child http://172.20.5.3:80 now UP"
level=debug msg="Propagating new UP status"
level=debug msg="Added outgoing tracing middleware httpd-httpd-main" middlewareName=tracing middlewareType=TracingForwarder entryPointName=web routerName=httpd_main@docker
level=debug msg="Creating middleware" middlewareType=Recovery entryPointName=web middlewareName=traefik-internal-recovery
level=debug msg="Creating middleware" middlewareType=Recovery entryPointName=webs middlewareName=traefik-internal-recovery
level=debug msg="Adding route for mydomain.com with TLS options default" entryPointName=web
level=debug msg="Adding route for mydomain.com with TLS options default" entryPointName=webs
level=debug msg="Trying to challenge certificate for domain [mydomain.com] found in HostSNI rule" rule="Host(`mydomain.com`)" providerName=certbot.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=httpd_main@docker
level=debug msg="Looking for provided certificate(s) to validate [\"mydomain.com\"]..." routerName=httpd_main@docker rule="Host(`mydomain.com`)" providerName=certbot.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
level=debug msg="Domains [\"mydomain.com\"] need ACME certificates generation for domains \"mydomain.com\"." providerName=certbot.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=httpd_main@docker rule="Host(`mydomain.com`)"
level=debug msg="Loading ACME certificates [mydomain.com]..." rule="Host(`mydomain.com`)" providerName=certbot.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=httpd_main@docker
level=debug msg="Building ACME client..." providerName=certbot.acme
level=debug msg="https://acme-v02.api.letsencrypt.org/directory" providerName=certbot.acme
level=error msg="Unable to obtain ACME certificate for domains \"mydomain.com\": cannot get ACME client get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get \"https://acme-v02.api.letsencrypt.org/directory\": dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: read udp 127.0.0.1:44201->127.0.0.11:53: i/o timeout" ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=httpd_main@docker rule="Host(`mydomain.com`)" providerName=certbot.acme

核心问题 #

错误日志明确显示DNS解析超时：Traefik容器无法解析acme-v02.api.letsencrypt.org域名，原因是Docker Compose中dns字段的配置错误——172.16.25.1末尾多了分号，导致DNS服务器配置失效，容器只能使用Docker内置DNS（127.0.0.11），而该DNS无法正常访问外部域名。

修复步骤 #

1. 修正DNS配置
   将dns字段中的- 172.16.25.1;改为- 172.16.25.1，移除末尾的分号，确保DNS服务器地址被正确识别：

   dns:
     - 172.16.25.1
   

2. 验证网络连通性
   进入Traefik容器测试DNS和网络：

   docker exec -it Traefik sh
   # 测试域名解析
   nslookup acme-v02.api.letsencrypt.org
   # 测试网络连通性
   ping 8.8.8.8
   

3. 确保OVH API权限正确
   确认在OVH生成的Consumer Key拥有对应域名的DNS编辑权限，避免后续DNS挑战失败（当前错误是DNS解析，后续需验证此点）。

4. 配置通配符证书规则
   若要生成*.mydomain.com通配符证书，需在路由规则中添加通配符域名，例如在后端服务的Traefik标签中设置：

   labels:
     - "traefik.http.routers.httpd_main.rule=Host(`mydomain.com`, `*.mydomain.com`)"
   

内容的提问来源于stack exchange，提问作者jaros85