Unable to obtain ACME certificate for domains - Cloudflare Tunnel

[Photo64]

I am trying to run Opencloud via these directions ->https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/docker-compose-base/. via a Cloudflare Tunnel. I am must have missed a step or possibly doing this all wrong but I followed all the steps however when I try to pull up the web page via my domain name I get a 502 error ( Unable to obtain ACME certificate for domains). In the logs for Traefik I can see it's looking for the A & AAAA records for cloud,collabora,traefik & wopiserver.

Has anyone run into this trying to access via Cloudflare Tunnel? Any suggestions on what I may have missed or need to do?

[micbar]

In the logs for Traefik I can see it's looking for the A & AAAA records for cloud,collabora,traefik & wopiserver.

These domains need to be set up and working. Reachable via the public network and from inside openCloud.

I don’t know how a cloudflare tunnel works. Can you give more context?

[Photo64]

In Cloudflare I have a tunnel setup then created a subdomain so my domain is myhome.com and the subdomain I set up is oc.myhome.com. I then created the 8 DNS records (4 A & 4 AAAA) for cloud/collabora/traefik/wopiserver. After starting the docker compose file I get the errors in the traefik container, here is a snippet ->

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [cloud.oc.myhome.com]: error: one or more domains had a problem:\n[cloud.oc.myhome.com] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up A for cloud.oc.myhome.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for cloud.oc.myhome.com - check that a DNS record exists for this domain\n" ACME CA=https://acme-staging-v02.api.letsencrypt.org/directory acmeCA=https://acme-staging-v02.api.letsencrypt.org/directory domains=["cloud.oc.myhome.com"] providerName=letsencrypt.acme routerName=opencloud@docker rule=Host(cloud.oc.myhome.com)

Would this be an issue with the setup of open cloud or an issue on how I setup the DNS records?

[micbar]

That is a dns issue.

[Photo64]

So I think I may have have got a little further but still hitting an issue. I can get to the Not Private page but when I check the certificate it shows me a Traefik Default Cert but in the instructions I should see the Lets Encrypt staging cert. Am I still hitting a DNS issue or is something else?

[Photo64]

I was able to get to the login page but when I entered the user & psd it denied me entry to the site. However when I commented out the INSECURE setting I was able to enter the site. I can't figure out why I can't enter the site with the INSECURE setting commented out but can with it set to true.

I have followed the docker-compose steps and even though I have created the A and AAAA records there seems to be an issue getting it to work that I can't figure out. I have been searching through issues but have not found a resolution. If there are things I can try please let me know.

[Photo64]

Does port 80 & 443 need to be forwarded? I am running into this error which shows 2 issues:

1. likely firewall problem - which makes me wonder about the ports
2. it shows 182.168.1.154. <- this should be 192.168.1.154. I can't figure out where the 182 is coming from.

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [cloud.redacted.com]: error: one or more domains had a problem:\n[cloud.redacted.com] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:connection :: 182.168.1.154: Fetching http://cloud.redacted.com/.well-known/acme-challenge/Pc6wfLue7fgB1_y6lcwCvw1TMviLlMfb07dgxktIdyA: Timeout during connect (likely firewall problem)\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["cloud.redacted.com"] providerName=letsencrypt.acme routerName=opencloud@docker rule=Host(cloud.redacted.com)

[frankferrari]

I am on a similar boat like you and want to contribute as I am looking forward to get this up and running correctly with Cloudflare Tunnel as well.

Briefly summarised Cloudflare Tunnel for OpenCloud:

• Exposes self-hosted OpenCloud without public IP or open inbound ports
• Outbound-only encrypted connection to Cloudflare's edge, shields origin from direct attacks
• Routes HTTPS traffic through Cloudflare's filters, blocking DDoS/malicious requests upstream
• Free tier available

Setup:

• Homeserver with dedicated VM on Proxmox
• Install with docker compose according to the docs

I stumbled into similar issues like you. Here is what I did:

1. Set Cloudflare DNS on Domain Registrator
2. Installed Cloudflared on Host (the VM)
3. Configure Cloudflare Tunnel (Published application routes)
   • cloud.MYDOMAIN.de
   • traefik.MYDOMAIN.de
     no collabora.MYDOMAIN or wopiserver.MYDOMAIN .. as I am not using it
   • each with
     Service set to: https://localhost:443 (as the tunnel is on the host and treafik listens to 443*
     Advanced: enable "No TLS Verify" (this skips verifying Traefik's certificate, I guess, which are for e.g. cloud.MYDOMAIN.de and not localhost )

Now I also cannot authenticated without setting INSECURE=true, which does not feel safe/ right, although the Tunnel should be safe as it is fully encrypted with Cloudflare's trusted certificates and just the internal service-to-service communication certificates seem to be unverified.

Correct me if I'm wrong. I am fairly new to all of this..

Is this the way to go?

[micbar]

Now I also cannot authenticated without setting INSECURE=true,

I must admit, i am unfamiliar with a Cloudflare tunnel. When setting INSECURE=true can you determine which request exactly fails?

[frankferrari]

{"level":"error","service":"proxy","error":"failed to verify access token: Get \"https://cloud.tdrehkopf.de/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate is valid for 030df66010f3a537b60c37451964dea4.bd8313c0e0946f140c963705e63e6cc1.traefik.default, not _MYDOMAIN_.de","authenticator":"oidc","path":"/ocs/v1.php/cloud/capabilities","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","client.address":"172.18.0.1","network.peer.address":"","network.peer.port":"","time":"2025-11-10T12:54:48Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}

So,.. the container is trying to reach https://MYDOMAIN.de/.well-known/openid-configuration but it's being routed through Traefik's internal network.

Expected domain: MYDOMAIN.de
Actual certificate domain: 030df66010f3a537b60c37451964dea4.bd8313c0e0946f140c963705e63e6cc1.traefik.default (a Traefik internal domain)

So, how I understand Cloudflare:

Browser
↓ [HTTPS - Cloudflare's Certificate]
Cloudflare's Edge Network
↓ [Cloudflare Tunnel - Encrypted]
cloudflared daemon (on my server)
↓ [HTTP/HTTPS to localhost:443]
Docker containers (Traefik → OpenCloud)

So, I think the setup with INSECURE is probably fine, when using Cloudflare Tunnel as

• All external traffic is protected by Cloudflare's certificates
• The Cloudflare Tunnel is encrypted
• Container-to-container traffic happens on an isolated Docker network (not exposed to the internet)
• My homeserver is not directly exposed to the internet

..but maybe we can find an expert on this topic, as I am not.

[micbar]

So,.. the container is trying to reach https://MYDOMAIN.de/.well-known/openid-configuration but it's being routed through Traefik's internal network.

Yes. That is because of the alias in the traefik container config. This request doesn't need to make the trip to the public net.