How to configure let's encrypt

[Cerebellum-ITM]

I'm adding the domain to a service, everything seems to be going well but in the traefik logs I get an error:
500 :: urn:ietf:params:acme:error:serverInternal :: During secondary validation: Secondary validation RPC failed\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=

The problem is that the subdomain where Dockploy is located (administrator panel) is not a problem, but the subdomain that the application will use gives the error I mentioned.

My subdomains are pointing to the server, and I can access them correctly, but the issue is the SSL.

I've never used Traefik, I've always used Caddy. Can someone help me please?

[Serhioromano]

As I know certificates are generated automatically. You do not need to configure it. Just wait a litle after new subdomain is used.

[djsisson]

The default let's encrypt certificate resolver in trarfik can obtain and use certificates for any domain

The error is from let's encrypt so without more info you will need to ask on their forums

[Serhioromano]

There should not be that limitation, and you should get certificate for any domain. I expect you have configured my2domain.com correctly using the same IP address.

[Cerebellum-ITM]

Thank you very much for your answers. I'll try again. Maybe it was just a mistake on my part. I'll also try updating Dockploy.

[Lexe003]

@Cerebellum-ITM I'm experiencing the same. Did you manage to solve it?

[LuiggiVal08]

My problem is that it doesn't generate a valid certificate; instead, it uses the default one from Dockploy, which isn't verified. I don't know how to get Let's Encrypt to generate a registered certificate.

[ashik4339]

The existing reply is right that Dokploy/Traefik handles cert issuance automatically (certResolver: letsencrypt, no manual config needed) — but that specific error, During secondary validation: Secondary validation RPC failed, points to something more specific than "just wait."

Since 2024, Let's Encrypt validates domain ownership from multiple independent geographic vantage points ("multi-perspective validation"), not just one. Dokploy's default challenge is HTTP-01 over port 80, so every one of those vantage points needs to reach http://your-subdomain/.well-known/acme-challenge/... successfully. Your working subdomain (Dokploy's own panel) passing while your app's subdomain fails on secondary (not primary) validation usually means:

1. A firewall/WAF/CDN in front of the app's subdomain blocking some regions — e.g. Cloudflare proxy set to "orange cloud" for that record, or a security group only allowlisting your own country's IP ranges. Check if that subdomain has anything (Cloudflare proxy, cloud firewall, fail2ban) that the panel's subdomain doesn't.
2. Incomplete DNS propagation — if the record was only just created, some resolvers worldwide may not see it yet even though yours does locally. Check propagation with something like https://dnschecker.org across regions, not just your own machine.
3. Port 80 specifically blocked (not 443) — HTTP-01 challenges need port 80 open even if you're only serving HTTPS traffic afterward.
4. Occasionally this is a transient Let's Encrypt infrastructure issue on their end — check https://letsencrypt.status.io before assuming it's your config, especially if it clears up on retry a few minutes later.

Since you're coming from Caddy: the difference is Caddy defaults to a more forgiving/automatic setup, while Traefik here is doing a stricter multi-region HTTP-01 check — so it's usually infra reachability, not a Dokploy config step you're missing.

Source: Dokploy docs (certResolver: letsencrypt / HTTP challenge default) + Let's Encrypt's own community forum confirming secondary-validation-specific failures and multi-perspective validation behavior.