Traefik fails to perform HTTP-01 ACME challenge with a 404 error.

[0xalivecow]

Hello all,

I am having an issue with the latest pangolin install at the moment. I had this running successfully before, but now I cannot get any TLS certificates fro my domains.
These tests have been done on a fully clean install of pangolin with only the ACME URL swapped with the staging one.

My environment is podman (rootful).

When starting the containers via sudo pdoman compose up -d, I get the following error in Traefik:

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [pangolin.REDACTED.de]: 
error: one or more domains had a problem:\n[pangolin.REDACTED.de] invalid authorization: acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 37.120.185.20: Invalid response from http://pangolin.REDACTED.de/.well-known/acme-
challenge/x1tJmZMkTq4sjbip6P1aHw5o0PiKKERuZtgTgR7UgLE: 404\n" ACME CA=https://acme-staging-v02.api.letsencrypt.org/
directory acmeCA=https://acme-staging-v02.api.letsencrypt.org/directory domains=["pangolin.REDACTED.de"] 
providerName=letsencrypt.acme routerName=next-router@file rule="Host(`pangolin.REDACTED.de`) && !PathPrefix(`/api/v1`)"

I am using the default Trefik configs from the installer. The host previously had a caddy running on it that had no issues with TLS certificate requests.

I really have no ideas left what the issue can be.

Does anyone know how I can fix this?

[LaurenceJJones]

Is your domain / a records pointing to the same IP address before you changed over to pangolin?

Most of the time it because the DNS records have not propagated out fully and is still going to the old record due to caching / propagation issues

[0xalivecow]

sudo podman container ls
[sudo] password for X: 
CONTAINER ID  IMAGE                            COMMAND               CREATED         STATUS                   PORTS                                                                                                               NAMES
a51ca6308279  docker.io/fosrl/pangolin:1.17.0  npm run start         13 minutes ago  Up 13 minutes (healthy)                                                                                                                      pangolin
c6c124c2eb54  docker.io/fosrl/gerbil:1.3.1     --reachableAt=htt...  13 minutes ago  Up 13 minutes            0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:443->443/udp, 0.0.0.0:21820->21820/udp, 0.0.0.0:51820->51820/udp  gerbil
6bd1db0d2ee9  docker.io/library/traefik:v3.6   --configFile=/etc...  13 minutes ago  Up 13 minutes            0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:443->443/udp, 0.0.0.0:21820->21820/udp, 0.0.0.0:51820->51820/udp  traefik

[0xalivecow]

curl http://localhost/.well-known/acme-challenge/test -v                  
* Host localhost:80 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:80...
*   Trying 127.0.0.1:80...
* Connected to localhost (127.0.0.1) port 80
* using HTTP/1.x
> GET /.well-known/acme-challenge/test HTTP/1.1
> Host: localhost
> User-Agent: curl/8.15.0
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 404 Not Found
< Date: Mon, 06 Apr 2026 10:07:21 GMT
< Content-Length: 0
< 
* Connection #0 to host localhost left intact

[0xalivecow]

Hang on, I think I found the issue. 100% layer 8 issue if it is what I think it is.

[0xalivecow]

Yes, I got it. My DNS configuration was indeed broken, but I was blind and did not see it.
I hope I did not waste your time too much and thank you for your replies!

[LaurenceJJones]

Not wasted as long as you fixed it 😄 in short its always DNS

[0xalivecow]

If you run into this issue, check your DNS config is not broken.