# Cannot set default SSL cert

**URL:** <https://community.traefik.io/t/cannot-set-default-ssl-cert/26335>\
**Category:** Traefik v3 (latest)\
**Tags:** kubernetes-ingress\
**Created:** [February 2, 2025, 6:23pm UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335 "2025-02-02T18:23:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![lrf](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lrf](https://community.traefik.io/u/lrf)\
**Post date:** [February 2, 2025, 6:23pm UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335/1 "2025-02-02T18:23:10Z")

</div>

Hello,

I'm trying to set up mTLS between Cloudflare and a Traefik ingress in our Kubernetes cluster.

Unfortunately, I am not able to set the Traefik default SSL certificate, despite following all the guidelines here:

> **[Traefik TLS Documentation - Traefik](https://doc.traefik.io/traefik/https/tls/#default-certificate)**
>
> Learn how to configure the transport layer security (TLS) connection in Traefik Proxy. Read the technical documentation.

When I inspect the SSL certificate served by my ingress, I always get a self-signed certificate.  
I'm using version 3.0.0

Does anyone know how to solve this?

Thanks

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 2, 2025, 10:22pm UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335/2 "2025-02-02T22:22:13Z")

</div>

If you follow the documentation to the point, it should work. If it does not work, then you should probably share your config.

---

<div class="post-metadata">

**Author:** ![lrf](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lrf](https://community.traefik.io/u/lrf)\
**Post date:** [February 3, 2025, 9:07am UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335/3 "2025-02-03T09:07:38Z")

</div>

I did follow the documentation but it didn't work.

This is the block in the helm values:

```auto
  tlsStore:
    default:
      defaultCertificate:
        secretName: default-certificate

```

anything else you want to check?

---

<div class="post-metadata">

**Author:** ![karthik-vishal\_magna](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/karthik-vishal_magna/32/9892_2.png) [@karthik-vishal\_magna](https://community.traefik.io/u/karthik-vishal_magna)\
**Post date:** [February 3, 2025, 5:18pm UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335/4 "2025-02-03T17:18:13Z")

</div>

Hey @bluepuma77

Sorry to say this. Your documentations doesn't have "to the point" explanations. Most of the examples for helmValues are not a part of the Schema and doesn't support. For example, there is no clear explanation on the IngressRoute for TCP neither in the helm values.schema.json nor in the documentation.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 4, 2025, 8:10am UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335/5 "2025-02-04T08:10:23Z")

</div>

It’s not "my" documentation, it’s a community forum, I am just a user. I don’t even use k8s.

I can just point you to the doc and hope you switch the example code to "Kubernetes".

If you don’t get help here, you can also try [www.reddit.com/r/Traefik/](https://www.reddit.com/r/Traefik/).

---

<div class="post-metadata">

**Author:** ![lrf](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lrf](https://community.traefik.io/u/lrf)\
**Post date:** [February 4, 2025, 8:44am UTC](https://community.traefik.io/t/cannot-set-default-ssl-cert/26335/6 "2025-02-04T08:44:06Z")

</div>

Thanks for the message. I totally agree with your comment.  
This product is advertised as "Cloud-native, GitOps-driven API runtime solutions for demanding DevOps and Platform Engineers" but it has one of the worst documentations I've ever seen on Kubernetes integration.  
That said, unfortunately I have to sort this out in some way and might try to load the config directly from files mounted on the pods.