# Certificates in consul?

**URL:** <https://community.traefik.io/t/certificates-in-consul/14419>\
**Category:** Traefik v2\
**Tags:** file, kv, docker-swarm, docker\
**Created:** [May 10, 2022, 11:36am UTC](https://community.traefik.io/t/certificates-in-consul/14419 "2022-05-10T11:36:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisbecke](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/chrisbecke/32/2042_2.png) [@chrisbecke](https://community.traefik.io/u/chrisbecke)\
**Post date:** [May 10, 2022, 11:36am UTC](https://community.traefik.io/t/certificates-in-consul/14419/1 "2022-05-10T11:36:45Z")

</div>

Its not clear how (or if its possible) to store certificate base64 data in consul when consul is being used as a configuration provider.

Attaching Consul as a configuration provider to Traefik provides a way to provide dynamic configuration to Traefik without needing direct access to the filesystem, or restart containers or anything, except, when configuring a new https/tls endpoint, when populating tls:certificates: or tls:stores: it always wants a "certFile: /path/to/file"

This is a problem - we implemented Consul to avoid needing to manage and accessing files.

---

<div class="post-metadata">

**Author:** ![jakubhajek](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jakubhajek/32/3389_2.png) [@jakubhajek](https://community.traefik.io/u/jakubhajek)\
**Post date:** [May 10, 2022, 2:57pm UTC](https://community.traefik.io/t/certificates-in-consul/14419/2 "2022-05-10T14:57:14Z")

</div>

Hello @chrisbecke

For storing certificates I would recommend using Vault as a Key-Value Data store when you can manually upload TLS certificates and Traefik will pick up the appropriate certificates that match a domain name.

Here is the recording explaining how it should be configured. [Tutorial: How to Use Traefik Enterprise and Vault // Traefik Labs - YouTube](https://youtu.be/PqkFvIXFxZc)

It also works fine for Traefik Proxy, so don't be surprised that in the video we use enterprise edition.

Thank you,

---

<div class="post-metadata">

**Author:** ![alexanderV](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alexanderv/32/7409_2.png) [@alexanderV](https://community.traefik.io/u/alexanderV)\
**Post date:** [July 31, 2023, 3:54pm UTC](https://community.traefik.io/t/certificates-in-consul/14419/3 "2023-07-31T15:54:18Z")

</div>

Hi,

I realise this is quite a late reply, but your message looked like it was exactly what I need. Thank you for posting a link to that YouTube video.

Can you confirm that both methods mentioned in the video are available in the open source traefik proxy? That is, both Vault PKI and Vault integration via Key-Value engine? In the latter case, I simply get an error message when trying to load the plugin.

Kind Regards,  
Alexander

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [August 1, 2023, 6:32am UTC](https://community.traefik.io/t/certificates-in-consul/14419/4 "2023-08-01T06:32:05Z")

</div>

Having plain certs inline of a dynamic config file works for Traefik open source, see [post](https://community.letsencrypt.org/t/how-to-continuously-create-renew-certificates-without-hitting-limits/184562/23).

Check if the plugin you mentioned is [on the list](https://doc.traefik.io/traefik/plugins/), then it should be available in Traefik open source.

If something does not work, describe the error and include the full error message.

Share your full Traefik static and dynamic config, and `docker-compose.yml` if used.