# Automatically reload self-signed certificates

**URL:** https://community.traefik.io/t/automatically-reload-self-signed-certificates/21717
**Category:** Traefik v2
**Tags:** docker, cli
**Created:** [March 4, 2024, 2:18pm UTC](https://community.traefik.io/t/automatically-reload-self-signed-certificates/21717 "2024-03-04T14:18:02Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![hshm](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@hshm](https://community.traefik.io/u/hshm)
#### Post date: [March 4, 2024, 2:18pm UTC](https://community.traefik.io/t/automatically-reload-self-signed-certificates/21717/1 "2024-03-04T14:18:02Z")

</div>

I'm trying to renew self-signed certificates on traefik without having to restart pods every time.

So far I have tried following configurations:

```auto
# docker-compose.yml
version: '3.9'

services:
  reverse-proxy:
    image: traefik:latest
    command:
      - --api.insecure=true
      - --providers.docker
      - --providers.file.directory=/etc/traefik/dynamic
      - --providers.file.watch=true
      - --entryPoints.web.address=:80
      - --entryPoints.websecure.address=:443
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /home/username/self_signed_cert/certs-traefik.yml:/etc/traefik/dynamic/certs-traefik.yml
      - /home/username/self_signed_cert/server.key:/etc/traefik/dynamic/server.key
      - /home/username/self_signed_cert/server.crt:/etc/traefik/dynamic/server.crt
      - /home/username/self_signed_cert/server.csr:/etc/traefik/dynamic/server.csr
      - /home/username/self_signed_cert/gen_self_signed_cert.sh:/gen_self_signed_cert.sh

```

```auto
# whoami-docker.yml

version: '3.9'

services:
  whoami:
    image: stefanscherer/whoami
    labels:
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls=true"
      - "traefik.http.routers.whoami.rule=Host(`whoami.mydomain.com`)"
      - "traefik.http.services.whoami-service.loadbalancer.server.port=8080"

```

```auto
# certs-traefik.yml

tls:
  certificates:
    - certFile: /etc/traefik/dynamic/server.crt
      keyFile: /etc/traefik/dynamic/server.key

```

```auto
# gen_self_signed_cert.sh

apk add openssl

echo "[whoami.mydomain]\nsubjectAltName = DNS:whoami.mydomain.com" >> /etc/ssl1.1/openssl.cnf

cd /etc/traefik/dynamic

openssl genrsa -aes128 -passout pass:123 2048 > server.key

openssl rsa -in server.key -out server.key -passin pass:123

openssl req -utf8 -new -key server.key -out server.csr -subj "/C=US/ST=NY/L=NY/O=IT/OU=IT/CN=IT/emailAddress=myemail@gmail.com" -passin pass:123

openssl x509 -in server.csr -out server.crt -req -signkey server.key -extfile /etc/ssl1.1/openssl.cnf -extensions whoami.mydomain -days 1460 -passin pass:123

chmod 600 server.key

touch certs-traefik.yml

```

and the initial certificate is generated by `openssl` as well.

I run the following commands and the containers come up:

```auto
docker-compose -f docker-compose.yml up -d
docker-compose -f whoami-compose.yml up -d

```

I have added the `touch` command hoping to trigger dynamic reloading according to [this link](https://github.com/traefik/traefik/issues/3083). My intention is to automatically renew the certificate e.g. for every 5 minutes using such a loop in my host:

```auto
for i in $(seq 20); do
 docker exec -it <traefik-container-id> /bin/sh ./gen_self_signed_cert.sh
 sleep 300 # seconds
done

```

Although this generates new certificates in the container but the changes don't reflect in [https://whoami.mydomain.com](https://whoami.mydomain.com) and the service uses the initial certificate every time. How can I possibly make traefik to some how watch the certificate files generated by openssl inside the container and use the renewed self-signed certificates?

---

<div class="post-metadata">

### Author: ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [March 4, 2024, 2:49pm UTC](https://community.traefik.io/t/automatically-reload-self-signed-certificates/21717/2 "2024-03-04T14:49:00Z")

</div>

First, you should not use an almost 2 year old Traefik release.

I would expect that you only need to `touch certs-traefik.yml` to update the timestamp and have `watch`ing `providers.file` reload the file.

---

<div class="post-metadata">

### Author: ![hshm](https://avatars.discourse-cdn.com/v4/letter/h/5f8ce5/32.png) [@hshm](https://community.traefik.io/u/hshm)
#### Post date: [March 5, 2024, 7:00am UTC](https://community.traefik.io/t/automatically-reload-self-signed-certificates/21717/3 "2024-03-05T07:00:33Z")

</div>

Thank you. I changed traefik image version to `latest` and kept other configurations (including `touch` command and `--providers.file.watch=true`) but it is still the same.