AdGuard Alias Cert not renewed

[andreasb]

• I'm running Adguard Home to support DoT/DoH for Clients
• limiting DNS to allowed clients is setup via Cloud Firewall, not within Adguard, ports 53 + 853 there are open for selected source IPs
• adding a new alias for a dedicated client ('client1.gate') works and a valid cert is deployed in /etc/certs within AdGuard docker container
• after some configuration changes and tests, I've been (again) adding the alias *.gate.mydomain.tld, which has been existing before and been removed again
  => creating the alias in Cloudron UI does not throw any error
  => however, an expired cert is used: when now accessing the AdGuard UI, an error message is visible on top saying
  
  =>I then renewed all certs via Cloudron Domain Mgmt, and regarding *.gate.mydomain.tld, the corresponding renewal log shows

2026-04-30T12:04:23.234Z reverseproxy: ensureCertificate: error: no http challenges

Am I facing the issue @girish described here?
Any idea how to fix this?

Thx in advance!

[james]

Hello @andreasb
Please include the output of cloudron-support --troubleshoot.
What DNS provider are you using?

[andreasb]

Hi @james

• 'cloudron-support --troubleshoot' did not throw any error
  
• DNS is not automated for this Cloudron, all entries are set manually at the registrar's web UI
  Does that help?

ps all other app certs seem to be renewed correctly, I haven't observed any issues here

[james]

Hello @andreasb
Please don't post pictures of copy-pasteable text.
With that you exclude our blind / visual impaired users.

@andreasb said:

DNS is not automated for this Cloudron, all entries are set manually at the registrar's web UI
Does that help?

That is the issue. With a manual DNS provider, you can not get a DNS challenge.
Only with a DNS challenge you can get wildcard certificates.
This is causing your issues. You should switch to a supported DNS provider.

[andreasb]

@james said:

Please don't post pictures of copy-pasteable text.

ok

[andreasb]

Hi @james
now switched to Hetzner Cloud DNS, and the renewal worked. Thanks!

Having used the manual wildcard config forever, I however still don't understand, how the first set of certs had been issued, that expired back in February.