# About using user-defined certificates with letsencrypt certificatesResolvers

**URL:** <https://community.traefik.io/t/about-using-user-defined-certificates-with-letsencrypt-certificatesresolvers/22228>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme\
**Created:** [April 11, 2024, 10:02am UTC](https://community.traefik.io/t/about-using-user-defined-certificates-with-letsencrypt-certificatesresolvers/22228 "2024-04-11T10:02:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mishar](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mishar](https://community.traefik.io/u/mishar)\
**Post date:** [April 11, 2024, 10:02am UTC](https://community.traefik.io/t/about-using-user-defined-certificates-with-letsencrypt-certificatesresolvers/22228/1 "2024-04-11T10:02:16Z")

</div>

I am using common traefik.yaml file for multiple environments. In some environments I am using letsencrypt and in some user-defined certificates. Can you tell me are the below configurations correct? Can I call user-defined certs under customCertResolver? For letsencrypt it works.

Traefik.yaml

```auto
entrypoints:
  http:
    address: :80
  https:
    address: :443
    http:
      tls: {}

certificatesResolvers:
  letsencrypt:
    acme:
      storage: /traefik/acme.json
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
      httpChallenge:
        entryPoint: http
  
  customCertResolver:
    tls:
      certificates:
        - certFile: "/var/run/secrets/traefik_tls_cert"
          keyFile: "/var/run/secrets/traefik_tls_key"

```

I am calling these certResolver from router file like this:  
traefik.http.routers.grafana.tls.certResolver: "{{ tls\_cert\_resolver }}"

{{ tls\_cert\_resolver }} This could be either letsencrypt or customCertResolver for different environments.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 12, 2024, 9:42am UTC](https://community.traefik.io/t/about-using-user-defined-certificates-with-letsencrypt-certificatesresolvers/22228/2 "2024-04-12T09:42:58Z")

</div>

This is not how it usually works, check [static config file reference](https://doc.traefik.io/traefik/reference/static-configuration/file/).

Custom TLS certs are loaded in a dynamic config file ([doc](https://doc.traefik.io/traefik/https/tls/#user-defined)), which you load in static config with `providers.file`. The you just enable TLS on `entrypoint` or `router` (yaml `tls: {}`, labels `tls=true`).

---

<div class="post-metadata">

**Author:** ![mishar](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mishar](https://community.traefik.io/u/mishar)\
**Post date:** [April 15, 2024, 7:01am UTC](https://community.traefik.io/t/about-using-user-defined-certificates-with-letsencrypt-certificatesresolvers/22228/3 "2024-04-15T07:01:52Z")

</div>

Well, here is my complete traefik file:

```auto
api:
  dashboard: true

providers:
  file:
    directory: /etc/traefik/config/
    watch: true
  swarm:
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false

entrypoints:
  http:
    address: :80
  https:
    address: :443
    http:
      tls: {}
  
certificatesResolvers:
  letsencrypt:
    acme:
      storage: /traefik/acme.json
      caServer: "https://acme-v02.api.letsencrypt.org/directory"
      httpChallenge:
        entryPoint: http
  
  customCertResolver:
    tls:
      certificates:
        - certFile: "/etc/traefik/config/traefik_tls_cert"
          keyFile: "/etc/traefik/config/traefik_tls_key" 

log:
  level: INFO

```

and my router labels are as follow:

```auto
labels:
        com.docker.stack.image: "{{ service.image }}"
        traefik.enable: "true"
        traefik.http.routers.grafana.entrypoints: "https"
        traefik.http.routers.grafana.rule: "Host(`{{ qa_domain }}`) && PathPrefix(`/`)"
        traefik.http.routers.grafana.service: "grafana"
        traefik.http.services.grafana.loadbalancer.server.port: "8080"
        traefik.http.routers.grafana.tls: "true"
        traefik.http.routers.grafana.tls.certResolver: "{{ tls_cert_resolver }}"

```

The question remains the same

I am calling these certResolvers from the router file like this:  
traefik.http.routers.grafana.tls.certResolver: "{{ tls\_cert\_resolver }}"

{{ tls\_cert\_resolver }} How can I call our custom certificates for qa env, as we only need letsencrypt for prod? what configurations do I need to provide? I tried as described above by creating customCertResolver, but it doesn't seem to be working. what is missing?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 15, 2024, 7:53am UTC](https://community.traefik.io/t/about-using-user-defined-certificates-with-letsencrypt-certificatesresolvers/22228/4 "2024-04-15T07:53:10Z")

</div>

Format you config with 3 backticks before and after, in yaml every space matters.

As stated before, Traefik static config has no `certFile`, so this should not work.