# Cannot get traefik to work with self-signed certificate - an exception cannot be added for the website

**URL:** <https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [October 22, 2021, 1:13pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212 "2021-10-22T13:13:49Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![arminus](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@arminus](https://community.traefik.io/u/arminus)\
**Post date:** [October 22, 2021, 1:13pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/1 "2021-10-22T13:13:49Z")

</div>

I'm trying to set up a docker/traefik environment for local development with a self signed certificate which I created for a domain 'local.dev' like so:

```auto
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout local.dev.key -out local.dev.crt

```

The only reasonable template config I've found so far is from the last answer [here](https://stackoverflow.com/questions/58584625/how-do-i-reference-a-self-signed-ssl-certificates-for-traefik-v2-in-a-docker-com) - basically all other examples I've found use letsencrypt which is not an option on a local dev box.

**docker-compose.yml:**

```auto
traefik:
  image: traefik:v2.1
  command:
    - --entrypoints.web.address=:80
    - --entrypoints.websecure.address=:443
    - --providers.docker=true
    - --providers.file.directory=/etc/traefik/dynamic_conf
    - --providers.file.watch=true
  ports:
    - 80:80
    - 443:443
  volumes:
    - /var/run/docker.sock:/var/run/docker.sock:ro
    - ./certs/:/certs/:ro
    - ./traefik.yml:/etc/traefik/dynamic_conf/conf.yml:ro

web:
  image: nginx:1.17.8-alpine
  labels:
    # http with redirection
    - traefik.http.middlewares.redirect-middleware.redirectscheme.scheme=https
    - traefik.http.routers.web-router.entrypoints=web
    - traefik.http.routers.web-router.rule=Host(`local.dev`)
    - traefik.http.routers.web-router.middlewares=redirect-middleware
    # https
    - traefik.http.routers.websecure-router.entrypoints=websecure
    - traefik.http.routers.websecure-router.tls=true
    - traefik.http.routers.websecure-router.rule=Host(`local.dev`)

```

**traefik.yml:**

```auto
tls:
  certificates:
    - certFile: /certs/local.dev.crt
      keyFile: /certs/local.dev.key

```

No errors on container startup, but Firefox doesn't accept the certificate on [https://local.dev](https://local.dev) (MOZILLA\_PKIX\_ERROR\_SELF\_SIGNED\_CERT) and doesn't give me the option to add an exception in the advanced dialog as it usually does with other self signed certs.

What seems strange is that the error message also says: "_local.dev uses a security technology called "HTTP Strict Transport Security (HSTS)", through which Firefox is only allowed to connect to the website via secure connections. Therefore, an exception cannot be added for the website_" - this kind of indicates, that although I'm calling it on https I get an insecure answer?

I've also explicitly added this URL as an exception in the certificate config, no change. And the same basically happens with Edge and Chrome.

What am I missing here? And has anybody a working configuration for using self signed certs in a local setup?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 22, 2021, 1:28pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/2 "2021-10-22T13:28:00Z")

</div>

> [@arminus](#):
>
> What seems strange is that the error message also says: " _local.dev uses a security technology called "HTTP Strict Transport Security (HSTS)", through which Firefox is only allowed to connect to the website via secure connections. Therefore, an exception cannot be added for the website_ " - this kind of indicates, that although I'm calling it on https I get an insecure answer?

You've visited this domain before and have received an HSTS response(or it can be baked into the browser, unlikely in this case).

You can clear the HSTS storage if it has been received as a header. Or you can use a provate browsing session.

---

<div class="post-metadata">

**Author:** ![arminus](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@arminus](https://community.traefik.io/u/arminus)\
**Post date:** [October 22, 2021, 1:40pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/3 "2021-10-22T13:40:40Z")

</div>

> [@cakiwi](#):
>
> You can clear the HSTS storage if it has been received as a header. Or you can use a provate browsing session.

Unfortunately this doesn't make a difference (cleared both the HSTS storage and tested in a private session), repeated in Chrome, same error.

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 22, 2021, 1:49pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/4 "2021-10-22T13:49:07Z")

</div>

Are you setting any of the strict transport security anywhere in your configuration?

Here:

```auto
    - ./traefik.yml:/etc/traefik/dynamic_conf/conf.yml:ro

```

Or even set in your nginx configuration?

`curl -ik https://local.dev` to see what headers are being returned.

---

<div class="post-metadata">

**Author:** ![arminus](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@arminus](https://community.traefik.io/u/arminus)\
**Post date:** [October 22, 2021, 2:01pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/5 "2021-10-22T14:01:11Z")

</div>

> [@cakiwi](#):
>
> Are you setting any of the strict transport security anywhere in your configuration?

If you mean

```auto
- traefik.http.routers.websecure-router.tls=true

```

then yes (see above).

> [@cakiwi](#):
>
> `url -ik https://local.dev` to see what headers are being returned.

And there's the problem: it says `HTTP/1.1 200 OK` on the first line ☹

(my entire config - copy&pasted from the 8x up-voted [stackoverflow answer](https://stackoverflow.com/questions/58584625/how-do-i-reference-a-self-signed-ssl-certificates-for-traefik-v2-in-a-docker-com) is listed above, so I assume there's something missing there?)

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 22, 2021, 2:47pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/6 "2021-10-22T14:47:39Z")

</div>

No, I'm asking about [strict transport security headers](https://doc.traefik.io/traefik/middlewares/http/headers/#stsseconds)

> [@arminus](#):
>
> And there's the problem: it says `HTTP/1.1 200 OK` on the first line ☹

Not really, STS is implemented in the browser. cURL doesn't care.

The headers should be listed under that, the sts header looks something like:  
`strict-transport-security: max-age=63072000; includeSubDomains`

If it is returned and not configured in traefik then look at nginx.

---

<div class="post-metadata">

**Author:** ![arminus](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@arminus](https://community.traefik.io/u/arminus)\
**Post date:** [October 22, 2021, 3:53pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/7 "2021-10-22T15:53:57Z")

</div>

> [@cakiwi](#):
>
> The headers should be listed under that, the sts header looks something like:  
> `strict-transport-security: max-age=63072000; includeSubDomains`
> 
> If it is returned and not configured in traefik then look at nginx.

Those headers are not returned.

Meanwhile, and just to get nginx as complication out of the way, I also tried a config from the [traefik.io blog](https://traefik.io/blog/traefik-2-0-docker-101-fc2893944b9d/) by basically commenting out the letsencrypt related directives and pulling in my self signed certs and adding the following labels:

```auto
      - "traefik.http.middlewares.my-appsts.headers.stsincludesubdomains=false"
      - "traefik.http.middlewares.my-appsts.headers.stspreload=true"
      - "traefik.http.middlewares.my-appsts.headers.stsseconds=31536000"
      - "traefik.http.middlewares.servicests.headers.isdevelopment=false"
      - "traefik.http.routers.my-app.middlewares=my-appsts"

```

curl now confirms that header:

```auto
HTTP/1.1 200 OK
Content-Length: 347
Content-Type: text/plain; charset=utf-8
Date: Fri, 22 Oct 2021 15:46:54 GMT
Strict-Transport-Security: max-age=31536000; preload

```

Regardless, Firefox still has the same problem ☹

But, I've found a workaround: Setting `network.stricttransportsecurity.preloadlist` to false in Firefox...

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 22, 2021, 3:58pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/8 "2021-10-22T15:58:54Z")

</div>

I think this indicates that the SiteSecurityServiceState.txt was not cleared properly.

Glad you have a resolution.

---

<div class="post-metadata">

**Author:** ![arminus](https://avatars.discourse-cdn.com/v4/letter/a/c5a1d2/32.png) [@arminus](https://community.traefik.io/u/arminus)\
**Post date:** [October 22, 2021, 4:05pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/9 "2021-10-22T16:05:35Z")

</div>

> [@cakiwi](#):
>
> I think this indicates that the SiteSecurityServiceState.txt was not cleared properly.

I double-checked that file, there is nothing stored there for local.dev and I ran all tests in private sessions anyway.

I just wonder, all the examples I found use LetsEncrypt - do people not have traefik in the loop on local dev boxes?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 22, 2021, 5:13pm UTC](https://community.traefik.io/t/cannot-get-traefik-to-work-with-self-signed-certificate-an-exception-cannot-be-added-for-the-website/12212/10 "2021-10-22T17:13:51Z")

</div>

Here is why:

> **[Chrome & Firefox now force .dev domains to HTTPS via preloaded HSTS](https://ma.ttias.be/chrome-force-dev-domains-https-via-preloaded-hsts/)**
>
> tl;dr: Chrome 63 (out since December 2017), will force all domains ending on .dev (and .