Traefik配置ACME时出现连接拒绝错误的原因排查

AI 小北

2026-8-5

问题：Traefik无法通过Let's Encrypt获取证书，提示DNS连接拒绝

我正尝试搭建Traefik代理及后端Nginx静态网站，但无法通过HTTPS访问该网站，原因是通过Let's Encrypt获取证书时出现问题。

Traefik使用的docker-compose.yml配置如下：

version: '3'

services:
  traefik:
    image: traefik:v2.9
    container_name: 001-traefik
    command:
      - "--log.level=DEBUG"
      - "--providers.docker"
      - "--providers.docker.exposedByDefault=false"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.http.http.redirections.entrypoint.to=https"
      - "--entrypoints.http.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.https.address=:443"
      - "--entrypoints.https.http.tls.certResolver=le"
      - "--certificatesresolvers.le.acme.tlschallenge=true"
      - "--certificatesresolvers.le.acme.email=email@email.de"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"

    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt/acme.json:/letsencrypt/acme.json
      - ./traefik.yml:/traefik.yml
    networks:
      - proxy

networks:
  proxy:
    external: true

启动Nginx容器后，Traefik日志报错如下：

time="2023-01-10T11:32:02Z" level=debug msg="Adding route for site1.myserver.de with TLS options default" entryPointName=https
time="2023-01-10T11:32:02Z" level=debug msg="Trying to challenge certificate for domain [site1.myserver.de] found in HostSNI rule" rule="Host(`site1.myserver.de`)" routerName=https-nginx@docker providerName=le.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2023-01-10T11:32:02Z" level=debug msg="Looking for provided certificate(s) to validate [\"site1.myserver.de\"]..." rule="Host(`site1.myserver.de`)" routerName=https-nginx@docker providerName=le.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2023-01-10T11:32:02Z" level=debug msg="Domains [\"site1.myserver.de\"] need ACME certificates generation for domains \"site1.myserver.de\"." providerName=le.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" rule="Host(`site1.myserver.de`)" routerName=https-nginx@docker
time="2023-01-10T11:32:02Z" level=debug msg="Loading ACME certificates [site1.myserver.de]..." routerName=https-nginx@docker providerName=le.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" rule="Host(`site1.myserver.de`)"
time="2023-01-10T11:32:07Z" level=debug msg="Serving default certificate for request: \"site1.myserver.de\""
time="2023-01-10T11:32:07Z" level=debug msg="http: TLS handshake error from 172.20.0.1:34672: remote error: tls: bad certificate"
time="2023-01-10T11:32:07Z" level=debug msg="Building ACME client..." providerName=le.acme
time="2023-01-10T11:32:07Z" level=debug msg="https://acme-v02.api.letsencrypt.org/directory" providerName=le.acme
time="2023-01-10T11:32:07Z" level=error msg="Unable to obtain ACME certificate for domains \"site1.myserver.de\": cannot get ACME client get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get \"https://acme-v02.api.letsencrypt.org/directory\": dial tcp:
lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: read udp 127.0.0.1:55896->127.0.0.11:53: read: connection refused" rule="Host(`site1.myserver.de`)" routerName=https-nginx@docker providerName=le.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"

请问为何会出现此“连接拒绝”错误？当前环境无防火墙或其他设备阻挡流量。

解决方法

日志中的核心错误是lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: read: connection refused，其中127.0.0.11是Docker内置的DNS服务器，说明Traefik容器无法访问Docker的DNS服务，导致无法解析Let's Encrypt的API域名。可按以下步骤排查修复：

重建外部网络proxy
Traefik使用的是外部网络proxy，若该网络的DNS配置异常会导致解析失败。删除并重建网络：
```
docker network rm proxy
docker network create proxy
```
重建后的网络会默认使用宿主机的DNS配置，通常能解决基础解析问题。
为Traefik容器手动指定DNS服务器
若重建网络无效，可在docker-compose.yml的Traefik服务中添加公共DNS配置（如Google或Cloudflare的DNS）：
```
services:
  traefik:
    image: traefik:v2.9
    container_name: 001-traefik
    dns:
      - 8.8.8.8
      - 1.1.1.1
    # 其余原有配置保持不变
```
验证容器内DNS连通性
修改配置后重启Traefik，进入容器测试解析：
```
docker exec -it 001-traefik sh
nslookup acme-v02.api.letsencrypt.org
```
若能正常返回IP，说明DNS问题已解决，Traefik可正常获取证书。
检查acme.json权限
若后续仍有证书获取问题，确认证书存储文件的权限为600（Traefik需要读写权限）：
```
chmod 600 ./letsencrypt/acme.json
```

内容的提问来源于stack exchange，提问作者FernSeher