# Certificate resolver

**URL:** <https://community.traefik.io/t/certificate-resolver/9424>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme\
**Created:** [January 25, 2021, 10:13am UTC](https://community.traefik.io/t/certificate-resolver/9424 "2021-01-25T10:13:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![evdel](https://avatars.discourse-cdn.com/v4/letter/e/85f322/32.png) [@evdel](https://community.traefik.io/u/evdel)\
**Post date:** [January 25, 2021, 10:13am UTC](https://community.traefik.io/t/certificate-resolver/9424/1 "2021-01-25T10:13:47Z")

</div>

Hello

I am using Traefik as a Kubernetes ingress controller. The static configuration is given through command line arguments.

I want to properly use the cert resolver. As a first step I use the acme staging server.

Here is the static configuration given :

```
      - "--certificatesresolvers.myresolver.acme.email={{ my_email }}"
      - "--certificatesresolvers.myresolver.acme.storage=acme.json"
      - "--certificatesresolvers.myresolver.acme.tlschallenge"
      - "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"

```

Then I referenced this resolver in the configuration of my IngressRoute like this :

tls:  
certResolver: myresolver  
domains:  
- main: "{{ my\_domain }}"

With this when I visit https://{{ my\_domain }} I expect to have the connexion secured using a certificate generated for {{ my\_domain }}, untrusted because it comes from lets encrypt staging server.

Though when I display the certificate being used I can see Traefik's default cert.

What am I doing wrong ?

Thanks

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [January 25, 2021, 12:23pm UTC](https://community.traefik.io/t/certificate-resolver/9424/2 "2021-01-25T12:23:33Z")

</div>

What does your router rule look like ?  
It the certResolver defined on the entrypoint or on the router?

[https://doc.traefik.io/traefik/routing/entrypoints/#tls](https://doc.traefik.io/traefik/routing/entrypoints/#tls)  
[https://doc.traefik.io/traefik/https/acme/#configuration-examples](https://doc.traefik.io/traefik/https/acme/#configuration-examples)

---

<div class="post-metadata">

**Author:** ![evdel](https://avatars.discourse-cdn.com/v4/letter/e/85f322/32.png) [@evdel](https://community.traefik.io/u/evdel)\
**Post date:** [January 25, 2021, 5:33pm UTC](https://community.traefik.io/t/certificate-resolver/9424/3 "2021-01-25T17:33:35Z")

</div>

Thank you for your quick answer.

It is defined at the router level :

```auto
kind: IngressRoute
apiVersion: traefik.containo.us/v1alpha1
metadata:
  name: traefik-ui
spec:
  routes:
    - kind: Rule
      match: Host(`{{ my_domain }}`)
      priority: 1000
      services:
        - name: traefik-ui
          port: 80
  tls:
    certResolver: myresolver
    domains:
      - main: "{{ my_domain }}"

```

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [January 25, 2021, 5:58pm UTC](https://community.traefik.io/t/certificate-resolver/9424/4 "2021-01-25T17:58:48Z")

</div>

First I'd recommend checking with the tool [https://letsdebug.net/](https://letsdebug.net/) using TLS-ALPN-01 to make sure there are not issues connecting to the container from letsencrypt.

Add `--log.level=DEDUG` to traefik and see if anything interesting turns up.

From my (very)limited knowledge on k8s configuration looks okay from the snippets you've provided.

---

<div class="post-metadata">

**Author:** ![evdel](https://avatars.discourse-cdn.com/v4/letter/e/85f322/32.png) [@evdel](https://community.traefik.io/u/evdel)\
**Post date:** [February 4, 2021, 8:31pm UTC](https://community.traefik.io/t/certificate-resolver/9424/5 "2021-02-04T20:31:33Z")

</div>

I saw the following error message with debug mode :

`http: TLS handshake error from 10.233.70.0:50727: remote error: tls: bad certificate`

---

<div class="post-metadata">

**Author:** ![evdel](https://avatars.discourse-cdn.com/v4/letter/e/85f322/32.png) [@evdel](https://community.traefik.io/u/evdel)\
**Post date:** [July 12, 2021, 3:49pm UTC](https://community.traefik.io/t/certificate-resolver/9424/6 "2021-07-12T15:49:38Z")

</div>

After digging further I understood the problem was the ability to use the acme.json file with 600 permissions.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [July 15, 2021, 3:50pm UTC](https://community.traefik.io/t/certificate-resolver/9424/7 "2021-07-15T15:50:24Z")

</div>

Closed on July 15, 2021, 3:50pm UTC

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.