p2pstream

Appearance

Issue a Wildcard Certificate with Cloudflare DNS-01 ​

Issue an ACME certificate through Cloudflare DNS-01 for wildcard hosts or deployments where validation ports cannot be exposed.

Use This When ​

Use DNS-01 when you need *.example.com, or when HTTP-01 and TLS-ALPN-01 cannot reach p2pstream from the public internet.

Prerequisites ​

  • The domain is hosted in Cloudflare DNS.

  • A Cloudflare API token that can edit DNS records for the target zone.

  • The Cloudflare zone ID.

  • Outbound HTTPS access to the Cloudflare and ACME APIs, plus outbound UDP and TCP port 53 access to the zone's authoritative nameservers. No inbound listener port is required for DNS-01 validation.

    Finding your Zone ID

    In the Cloudflare dashboard, select your domain. The Zone ID appears in the right-hand sidebar under API.

  • An HTTPS listener such as public-https.

Steps ​

  1. In Cloudflare, create a scoped API token with DNS edit permission for the target zone.

  2. Open TLS, go to the DNS Credentials section, and select Add DNS credential:

    FieldValue
    Namecloudflare-example
    ProviderCloudflare
    Zone IDyour Cloudflare zone ID
    API tokenyour scoped token
    EnabledOn

    The API token is stored server-side and later shown as set, not echoed back in full.

    p2pstream Edit DNS Credential drawer showing the Cloudflare zone ID and saved API token state
    The DNS credential drawer stores the Cloudflare zone ID and API token server-side so DNS-01 certificate mappings can create ACME validation records.

  3. On TLS, select Add certificate and create the certificate mapping:

    FieldValue
    Listenerpublic-https
    Hostname pattern*.example.com
    MethodDNS-01
    CALet's Encrypt staging first
    Emailyour ACME account email
    DNS credentialcloudflare-example
    EnabledOn
    p2pstream Edit TLS Mapping drawer showing DNS-01 with a wildcard hostname and Cloudflare credential
    The DNS-01 mapping drawer selects the wildcard hostname pattern, HTTPS listener, ACME CA, and Cloudflare credential used for validation.

  4. After staging issuance works, switch the CA to Let's Encrypt production and renew.

  5. Create matching routes. Wildcard TLS only provides the certificate.

    Host patternPath prefixTarget
    app.example.com/app
    media.example.com/media
    *.example.com/fallback

Verification ​

The certificate status should become ready. Then test a routed wildcard host:

bash
curl -I https://app.example.com

Troubleshooting ​

SymptomCheck
DNS credential rejectedZone ID cannot be empty or contain whitespace/path characters.
Certificate issuance failsToken must edit DNS records for the zone.
Public delegation mismatchThe configured Zone ID must identify the active Cloudflare zone whose assigned nameservers match the domain's public NS records.
Authoritative TXT check times outPermit outbound UDP and TCP port 53 from the p2pstream container to the authoritative nameservers. The error identifies the nameserver that did not return the expected record.
TLS works but route failsOpen the hostname's site under Proxy -> Sites, check publication and listener assignments, and add or fix its route.
Apex host not covered*.example.com does not cover example.com; add a separate mapping if needed.

Next Steps ​

Operations documentation for self-hosted p2pstream deployments.