title: Unable to obtain ACME certificate for domains - trying to setup HTTPS in virtual localhost on docker
body: <p>I am trying to setup a certificate for a locally running react app on a virtual host <code>local.example.com</code>. This has to just work locally on docker setup. After going through some articles, I came up with this docker-compose.yml:</p>
  <pre class="lang-yaml prettyprint-override"><code>version: &quot;3&quot;
  services:
    mongo:
      image: mongo
      restart: always
      ports:
        - &quot;27017:27017&quot;
      volumes:
        - mongodbdata:/data/db
      networks:
        - proxy
    mongo-express:
      image: mongo-express
      restart: always
      ports:
        - &quot;8081:8081&quot;
      networks:
        - proxy
    react:
      build:
        context: ./client
        dockerfile: ./Dockerfile
      ports:
        - &quot;3001:3001&quot;
      stdin_open: true
      volumes:
        - ./client:/client
        - /client/node_modules
      labels:
        # this enables traefik for your service
        - &quot;traefik.enable=true&quot;
        # this defines the url, traefik will get the ssl certificate for
        - &quot;traefik.http.routers.myapplication.rule=Host(`local.example.com`)&quot;
        # this tells traefik to use https to access the website
        - &quot;traefik.http.routers.myapplication.entrypoints=websecure&quot;
        # this tells traefik to use the certresolver, that we defined above for resolving tls (in our case letsencrypt)
        - &quot;traefik.http.routers.myapplication.tls.certresolver=myresolver&quot;
        # this let's us forward the port we set above. Change this to the port you expose in your application (3000, 4000, ...) or remove the line, if your application already exposes port 80/443
        - &quot;traefik.http.services.myapplication.loadbalancer.server.port=3000&quot;
      depends_on:
        - &quot;server&quot;
      networks:
        - proxy
    server:
      build:
        context: ./server
        dockerfile: ./Dockerfile
      ports:
        - &quot;5001:5001&quot;
      volumes:
        - traefik.toml:/traefik.toml
        - acme.json:/acme.json
        - ./server:/server
        - /server/node_modules
      labels:
        # this enables traefik for your service
        - &quot;traefik.enable=true&quot;
        # this defines the url, traefik will get the ssl certificate for
        - &quot;traefik.http.routers.myapplication.rule=Host(`local.example.com`)&quot;
        # this tells traefik to use https to access the website
        - &quot;traefik.http.routers.myapplication.entrypoints=websecure&quot;
        # this tells traefik to use the certresolver, that we defined above for resolving tls (in our case letsencrypt)
        - &quot;traefik.http.routers.myapplication.tls.certresolver=myresolver&quot;
        # this let's us forward the port we set above. Change this to the port you expose in your application (3000, 4000, ...) or remove the line, if your application already exposes port 80/443
        - &quot;traefik.http.services.myapplication.loadbalancer.server.port=5001&quot;
      depends_on:
        - &quot;mongo&quot;
      networks:
        - proxy
    whoami:
      image: &quot;containous/whoami&quot;
      container_name: &quot;myapplication&quot;
      restart: unless-stopped
      ports:
        - &quot;4000:4000&quot;
      networks:
        - proxy
  
    traefik:
      image: &quot;traefik:v2.2&quot;
      container_name: &quot;traefik&quot;
      command:
        # this can be uncommented to get more information, in case something doesn't work
        - &quot;--log.level=DEBUG&quot;
        # set this to true to get access to the traefik web interface unter http://YOURIP:8080
        - &quot;--api.insecure=false&quot;
        - &quot;--providers.docker=true&quot;
        - &quot;--providers.docker.exposedbydefault=true&quot;
        - &quot;--entrypoints.web.address=:80&quot;
        - &quot;--entrypoints.websecure.address=:443&quot;
        - &quot;--certificatesresolvers.myresolver.acme.httpchallenge=true&quot;
        - &quot;--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web&quot;
          #- &quot;--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory&quot; # uncomment this line to only test ssl generation first (to make sure you don't run into letsencrypt limits)
        - &quot;--certificatesresolvers.myresolver.acme.email=kamlekar.venkatesh@gmail.com&quot;
        - &quot;--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json&quot;
      ports:
        - &quot;80:80&quot;
        - &quot;443:443&quot;
        - &quot;8080:8080&quot; # this is used for the web interface, that let's you check and monitor traefik and your configuration. It's very nice for debugging your config - only available if &quot;api.insecure&quot; above is set to true
      volumes:
        - &quot;./letsencrypt:/letsencrypt&quot;
        - &quot;/var/run/docker.sock:/var/run/docker.sock:ro&quot;
      networks:
        - proxy
      # The following is only necessary if you want to enforce https!
      # if you don't need that, you can just remove the labels here
      labels:
        - &quot;traefik.http.routers.http-catchall.rule=hostregexp(`{host:.+}`)&quot;
        - &quot;traefik.http.routers.http-catchall.entrypoints=web&quot;
        - &quot;traefik.http.routers.http-catchall.middlewares=redirect-to-https&quot;
        - &quot;traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https&quot;
  
  networks:
    proxy:
      external: true
  
  volumes:
    mongodbdata:
    traefik.toml:
    acme.json:
  </code></pre>
  <p>On doing <code>docker-compose up</code>, I am seeing the following error in <code>traefik</code> service. Also, though the react app service is running in docker but I hit <code>https://local.example.com:3001</code>, is unreachable</p>
  <blockquote>
  <p>time=&quot;2022-01-23T08:30:52Z&quot; level=error msg=&quot;Unable to obtain ACME certificate for domains &quot;local.example.com&quot;: unable to generate a certificate for the domains [local.example.com]: error: one or more domains had a problem:\n[local.example.com] acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for local.example.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for local.example.com - check that a DNS record exists for this domain, url: \n&quot; providerName=myresolver.acme routerName=myapplication@docker rule=&quot;Host(<code>local.example.com</code>)&quot;</p>
  </blockquote>
  <p>Here are the <a href="https://gist.github.com/kamlekar/f962dbc80f4b02b078864a476688b813" rel="nofollow noreferrer">research notes</a> which I tried till now (These notes for only my personal understanding so could be not in detail)</p>
  <p>You can start from this fiddle: <a href="https://github.com/kamlekar/react-docker-ssl-virtualhost" rel="nofollow noreferrer">https://github.com/kamlekar/react-docker-ssl-virtualhost</a></p>