[GH-ISSUE #29] Unable to obtain certificate from letsencrypt #28

New issue

Closed

opened 2026-05-06 12:22:49 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-06 12:22:49 +02:00

Owner

Originally created by @akanealw on GitHub (Apr 30, 2026).
Original GitHub issue: https://github.com/chr0nzz/traefik-manager/issues/29

Originally assigned to: @chr0nzz on GitHub.

I've been wanting to switch to a simpler Traefik manager for a while and this project looks very good. However I'm having problems getting my domain certificate.

I've scoped an api key from Cloudflare as DNS.Zone.Edit and DNS.ZONE.Read but am getting the following error in my traefik docker log. (Domain name changed in error log of course.)

ERR Unable to obtain ACME certificate for domains error="cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["manager.example.com"] providerName=letsencrypt.acme routerName=traefik-manager@docker rule=Host(manager.example.com)

I used the setup script for the full stack and selected the Let's Encrypt - DNS: Cloudflare option.

Originally created by @akanealw on GitHub (Apr 30, 2026). Original GitHub issue: https://github.com/chr0nzz/traefik-manager/issues/29 Originally assigned to: @chr0nzz on GitHub. I've been wanting to switch to a simpler Traefik manager for a while and this project looks very good. However I'm having problems getting my domain certificate. I've scoped an api key from Cloudflare as DNS.Zone.Edit and DNS.ZONE.Read but am getting the following error in my traefik docker log. (Domain name changed in error log of course.) `ERR Unable to obtain ACME certificate for domains error="cannot get ACME client cloudflare: some credentials information are missing: CLOUDFLARE_EMAIL,CLOUDFLARE_API_KEY or some credentials information are missing: CLOUDFLARE_DNS_API_TOKEN,CLOUDFLARE_ZONE_API_TOKEN" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["manager.example.com"] providerName=letsencrypt.acme routerName=traefik-manager@docker rule=Host(`manager.example.com`)` I used the setup script for the full stack and selected the Let's Encrypt - DNS: Cloudflare option.

BreizhHardware

2026-05-06 12:22:49 +02:00

closed this issue
added the
bug
label

BreizhHardware commented

2026-05-06 12:22:49 +02:00

Author

Owner

@chr0nzz commented on GitHub (Apr 30, 2026):

Thanks for the report - this is a bug in the setup script. The installer was injecting your token as CF_API_TOKEN but Traefik's ACME library (lego) only recognizes CF_DNS_API_TOKEN for scoped API tokens, so it falls back to looking for the global key variables and fails.

Quick fix without reinstalling:

Open the docker-compose.yml generated by the installer
Find the Traefik service environment: block
Rename CF_API_TOKEN to CF_DNS_API_TOKEN
Restart: docker compose up -d traefik
Your token permissions (DNS Zone Edit + Zone Read) are correct - the variable name was just wrong.

This is fixed in the installer for future installs and will be released later on the weekend

@chr0nzz commented on GitHub (Apr 30, 2026): Thanks for the report - this is a bug in the setup script. The installer was injecting your token as CF_API_TOKEN but Traefik's ACME library (lego) only recognizes CF_DNS_API_TOKEN for scoped API tokens, so it falls back to looking for the global key variables and fails. Quick fix without reinstalling: Open the docker-compose.yml generated by the installer Find the Traefik service environment: block Rename CF_API_TOKEN to CF_DNS_API_TOKEN Restart: docker compose up -d traefik Your token permissions (DNS Zone Edit + Zone Read) are correct - the variable name was just wrong. This is fixed in the installer for future installs and will be released later on the weekend

BreizhHardware commented

2026-05-06 12:22:49 +02:00

Author

Owner

@akanealw commented on GitHub (Apr 30, 2026):

that was it, thank you! looking forward to testing this out.

@akanealw commented on GitHub (Apr 30, 2026): that was it, thank you! looking forward to testing this out.