# Default certificate from letsencrypt

**URL:** <https://community.traefik.io/t/default-certificate-from-letsencrypt/11697>\
**Category:** Traefik v2\
**Tags:** file\
**Created:** [September 8, 2021, 2:08am UTC](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697 "2021-09-08T02:08:56Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![jordantrizz](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jordantrizz/32/7003_2.png) [@jordantrizz](https://community.traefik.io/u/jordantrizz)\
**Post date:** [April 18, 2023, 5:23pm UTC](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697/21 "2023-04-18T17:23:54Z")

</div>

What @FrancYescO provided is the solution here. But it would be great if you could set the default Traefik SSL certificate to a certificate in the acme.json store versus dumping it and configuring it.

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [April 18, 2023, 5:27pm UTC](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697/22 "2023-04-18T17:27:12Z")

</div>

> **[Traefik TLS Documentation - Traefik](https://doc.traefik.io/traefik/https/tls/#acme-default-certificate)**
>
> Learn how to configure the transport layer security (TLS) connection in Traefik Proxy. Read the technical documentation.

---

<div class="post-metadata">

**Author:** ![jordantrizz](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jordantrizz/32/7003_2.png) [@jordantrizz](https://community.traefik.io/u/jordantrizz)\
**Post date:** [April 18, 2023, 6:00pm UTC](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697/23 "2023-04-18T18:00:26Z")

</div>

> [@FrancYescO](#):
>
> ```auto
> traefik-certs-dumper:
> image: ldez/traefik-certs-dumper:latest
> container_name: traefik-certs-dumper
> entrypoint: sh -c '
> apk add jq
> ; while ! [-e /data/acme.json]
> || ! [`jq ".Certificates | length" /data/acme.json` != 0]; do
> sleep 1
> ; done
> && traefik-certs-dumper file --watch --version v2 --source /data/acme.json'
> volumes:
> - ssl_certs:/data
> 
> ```

Updated to work with Traefik v2, be gentle I'm a newb

```auto
  traefik-certs-dumper:
    image: ldez/traefik-certs-dumper:v2.7.0
    container_name: traefik-certs-dumper
    entrypoint: sh -c 'apk add jq;
      while ! [-e /data/acme.json] || ! [`jq ".[] | select(.Certificates?) | .Certificates | length" /data/acme.json` != 0 ]; do
          sleep 1;
      done && traefik-certs-dumper file --source /data/acme.json --dest /data/certs --version v2;
      traefik-certs-dumper file --watch --source /data/acme.json --dest /data/certs --version v2'
    volumes:
      - /srv/traefik/:/data

```

---

<div class="post-metadata">

**Author:** ![jordantrizz](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/jordantrizz/32/7003_2.png) [@jordantrizz](https://community.traefik.io/u/jordantrizz)\
**Post date:** [April 18, 2023, 6:55pm UTC](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697/24 "2023-04-18T18:55:16Z")

</div>

Thanks @Idez I didn't understand it at first but figured it out.

Define the defaultgeneratedcert

```auto
      - "traefik.tls.stores.default.defaultgeneratedcert.resolver=letsencrypt"
      - "traefik.tls.stores.default.defaultgeneratedcert.domain.main=domain.com"
      - "traefik.tls.stores.default.defaultgeneratedcert.domain.sans=*.domain.com, *.docker01.domain.com"

```

But this won't generate a certificate using the above resolver. You need to define a https router first.

```auto
      - traefik.http.routers.traefik-secure.tls=true
      - traefik.http.routers.traefik-secure.tls.domains[0].main=domain.com
      - traefik.http.routers.traefik-secure.tls.domains[0].sans=*.domain.com
      - traefik.http.routers.traefik-secure.tls.domains[1].sans=*.docker01.domain.com
      - "traefik.http.routers.traefik-secure.tls.certresolver=letsencrypt"

```

In each of your docker containers, don't even specify a resolver so they don't get included in the certificate since you already have a wildcard.

```auto
      - "traefik.enable=true"
      - "traefik.http.routers.kuma-secure.entrypoints=websecure"
      - "traefik.http.routers.kuma-secure.rule=Host(`kuma.docker01.domain.com`,`kuma.domain.com`)"
      - "traefik.http.routers.kuma-secure.tls=true"
      - "traefik.http.routers.kuma-secure.service=kuma"
      - "traefik.http.services.kuma.loadbalancer.server.port=3001"
      - "traefik.docker.network=traefik-proxy"

```

I might be misunderstanding this, so correct me if I'm wrong.

[Previous page](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697.md?page=1)