ACME plugin keeps trying to generate certificates for subdomains

[icharlie]

kong version: 2.6.0

The acme plugin keeps trying to generate certificates for all subdomains are not in config domains and there is a wildcard certificate already. This causes hitting letsencrypt rate limit very often when you have very amount of subdomains.

When I check the ACMEHandler:certificate function, looks like kong_certificate.find_certificate would handle wildcard scenario but not the same in client.load_certkey_cached(conf, host). Not sure it is a bug or not.

Is there a way to prevent generating the certificate when there is a wildcard one already?

Thanks!

[fffonion]

Hi @icharlie , is your wildcard certificate being correctly picked up when acme plugin is not enabled? Are you using database mode
or dbless to config Kong?

[icharlie]

Hi @fffonion,

Q1. Yes, the wildcard certificate is still working after disabled acme plugin and I forgot to mention the wildcard certificate is managed by ingress controller not acme plugin.
Unfortunately, I can't disable the acme plugin to avoid this issue because there are also vary amount of domains can't be covered by wildcard certificate.

Q2. Yes, I am using database mode.

Thanks!

[fffonion]

@icharlie In database mode acme plugin doesn't take over the certificate selecting, so if the wildcard cert can be picked up
without the acme plugin, it should still be with the acme plugin. I will do some testing and get back to you.

[icharlie]

@fffonion I think I found the cause, the wildcard domain was in the acme plugin config (the domains section), and looks like it shouldn't be in it. 😅

The production environment stops try generating all subdomain ssl certificates after removed the wildcard domain from acme plugin config.

[fffonion]

@icharlie No problem, in that case I will mark this thread as resolved : )

[icharlie]

@fffonion Thank you!