DNS challenge

Coolify's default Traefik configuration uses the ACME HTTP challenge, which requires public access to port 80. Switch to the DNS challenge when you need wildcard certificates or cannot make port 80 reachable during certificate validation.

Traefik uses its Lego DNS provider integration to create a temporary _acme-challenge TXT record, waits for DNS validation, and removes the record after the certificate is issued.

What you need

• a domain hosted by a DNS provider supported by Lego
• provider credentials that can create and delete DNS records for the required zone

Change the Traefik configuration

Open Servers > your server > Proxy > Configuration. Keep the existing Docker Compose configuration, then make two changes inside the traefik service:

1. Add the DNS provider credentials under environment.
2. Remove the two httpchallenge command flags and add the provider's dnschallenge flags.

Each example visually marks the lines to remove and add. Keep the other values from your existing proxy configuration.

services:
  traefik:
    environment: 
      - CF_DNS_API_TOKEN=<cloudflare-api-token>
    command:
      # Keep the other existing command values.
      - '--certificatesresolvers.letsencrypt.acme.httpchallenge=true'
      - '--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=http'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=cloudflare'
      - '--certificatesresolvers.letsencrypt.acme.dnschallenge.delaybeforecheck=0'
      - '--certificatesresolvers.letsencrypt.acme.storage=/traefik/acme.json'

For another provider, use the identifier and environment variables from the Lego DNS provider documentation.

Restart and verify

Save the proxy configuration, then select Restart Proxy. Redeploy one resource with an HTTPS domain to trigger certificate issuance.

Verify that the domain serves a valid certificate and inspect Servers > your server > Proxy > Logs for ACME messages.

Troubleshooting

Continue with Wildcard Certificates when you need one certificate for multiple subdomains.