# Dynamically updating TLS configuration in Traefik 1.7

**URL:** <https://community.traefik.io/t/dynamically-updating-tls-configuration-in-traefik-1-7/8971>\
**Category:** Traefik v1\
**Tags:** file, docker-swarm, docker\
**Created:** [December 11, 2020, 1:01pm UTC](https://community.traefik.io/t/dynamically-updating-tls-configuration-in-traefik-1-7/8971 "2020-12-11T13:01:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![juliank](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/juliank/32/3046_2.png) [@juliank](https://community.traefik.io/u/juliank)\
**Post date:** [December 11, 2020, 1:01pm UTC](https://community.traefik.io/t/dynamically-updating-tls-configuration-in-traefik-1-7/8971/1 "2020-12-11T13:01:33Z")

</div>

We are running Traefik 1.7 (Docker image traefik:v1.7.26), and I'm currently trying to get the TLS configuration to reload dynamically - without having to restart Traefik - whenever we make any changes to it.

According to [the documentation](https://doc.traefik.io/traefik/v1.7/configuration/entrypoints/#dynamic-certificates), this should be possible using the file provider. We have a configuration using [multiple separated files](https://doc.traefik.io/traefik/v1.7/configuration/backends/file/#multiple-separated-files), with the _directory option_ set to `"/etc/traefik/file-rules"` (which is a directory mounted in the Docker configuration) and the _watch option_ set to `true`.

Inside `"/etc/traefik/file-rules"` we have placed a file `certificates.toml` with the following content:

```auto
# HTTPS certificates
[[tls]]
  entryPoints = ["https"]
  minVersion = "VersionTLS12"
  [tls.certificate]
    certFile = "/etc/ssl/foo.local.crt"
    keyFile = "/etc/ssl/foo.local.key"
# [[tls]]
# entryPoints = ["https"]
# minVersion = "VersionTLS12"
# [tls.certificate]
# certFile = "/etc/ssl/bar.local.crt"
# keyFile = "/etc/ssl/bar.local.key"

```

_(`"/etc/ssl` is also a directory mounted in the Docker configuration)_

With this configuration, I can successfully navigate to `https://foo.local/`, and I get a valid TLS connection (foo.local takes me to Docker container running _traefik/whoami_ with a host rule for _foo.local_). Based on this, my simple conclusion is that at least out basic configuration is correct.

Navigating to `https://bar.local/` (a different _traefik/whoami_ container with a host rule for _bar.local_) naturally gives me a certificate error (since no certificate exists for that host, I get the default untrusted Traefik certificate).

Now what I _ **would like to achieve** _, is to simply remove the comments for the _bar.local_ certificate, save the file, and get the configuration dynamically reloaded. This however does not happen. I would also like to be able to replace the _foo.local_ certificate files and get the new certificate dynamically updated. This doesn't happen either. If I however restart the Traefik container, all changes are reflected and I get a valid certificate for `https://bar.local/` and a new certificate is served for `https://foo.local/` (which indicates that the configuration is still correct).

**My question is therefore** : Why doesn't the certificate configuration reload dynamically? According to both [the documentation](https://doc.traefik.io/traefik/v1.7/configuration/entrypoints/#dynamic-certificates) and [this old merge request](https://github.com/traefik/traefik/pull/2233) from way back in 2017 indicate that this should indeed be possible.

We do also have other toml files in the `file-rules` directory (with various route rules for different frontends), and for that route configuration the dynamic reloading works as expected.

---

<div class="post-metadata">

**Author:** ![juliank](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/juliank/32/3046_2.png) [@juliank](https://community.traefik.io/u/juliank)\
**Post date:** [January 4, 2021, 8:36am UTC](https://community.traefik.io/t/dynamically-updating-tls-configuration-in-traefik-1-7/8971/2 "2021-01-04T08:36:51Z")

</div>

Shameless bump: We have not managed to get any further with this issue, and since it appears to be something that is in conflict with what is stated in the documentation, I feel that a bump is justified.

The gist of it all is:

> Why doesn't the certificate configuration reload dynamically? According to both [the documentation](https://doc.traefik.io/traefik/v1.7/configuration/entrypoints/#dynamic-certificates) and [this old merge request](https://github.com/traefik/traefik/pull/2233) from way back in 2017 indicate that this should indeed be possible.