# Entrypoint does not resolve service correctly if tls.certResolver is set

**URL:** <https://community.traefik.io/t/entrypoint-does-not-resolve-service-correctly-if-tls-certresolver-is-set/26333>\
**Category:** Traefik v3 (latest)\
**Tags:** letsencrypt-acme\
**Created:** [February 2, 2025, 4:40pm UTC](https://community.traefik.io/t/entrypoint-does-not-resolve-service-correctly-if-tls-certresolver-is-set/26333 "2025-02-02T16:40:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![leonixyz](https://avatars.discourse-cdn.com/v4/letter/l/57b2e6/32.png) [@leonixyz](https://community.traefik.io/u/leonixyz)\
**Post date:** [February 2, 2025, 4:40pm UTC](https://community.traefik.io/t/entrypoint-does-not-resolve-service-correctly-if-tls-certresolver-is-set/26333/1 "2025-02-02T16:40:03Z")

</div>

I struggled hours trying to understand what is wrong with my setup, until I discovered that removing the `tls.certResolver` option (using an ACME provider) from my HTTP router is the key. But I don't understand why, please explain me what is going on... I need to reintroduce that option.

**The problem** : I am getting a 404 when trying to access my service

**Consider the following** :

1. I am working on a local development environment. I expect ACME protocol to fail: no problem

2. My initial setup involved several services, i cut them down to the essential: traefik and a webservice

3. When I uncomment the `tls.certResolver` option from by _base.yml_ config, I can clearly see that the entrypoint does not match any service. This is reflected by the logs, which does not include any `ServiceName`:

4. The dashboard, however, does not seem to indicate any problem with the chaining from Entrypoint to Router to Service:  

5. It simply seem that the failing of the ACME protocol (as shown by the last line in the [logs](https://pastebin.com/zccJjws3) - which were too long to attach here) determines the unavailability of the service by the entrypoint

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 2, 2025, 10:31pm UTC](https://community.traefik.io/t/entrypoint-does-not-resolve-service-correctly-if-tls-certresolver-is-set/26333/2 "2025-02-02T22:31:33Z")

</div>

You enable TLS on web and websecure, that seems strange. Usually you would assign the certResolver only to websecure entrypoint. Or assign certResolver to router that only listen on websecure. Check [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt).

---

<div class="post-metadata">

**Author:** ![leonixyz](https://avatars.discourse-cdn.com/v4/letter/l/57b2e6/32.png) [@leonixyz](https://community.traefik.io/u/leonixyz)\
**Post date:** [February 5, 2025, 7:32pm UTC](https://community.traefik.io/t/entrypoint-does-not-resolve-service-correctly-if-tls-certresolver-is-set/26333/3 "2025-02-05T19:32:18Z")

</div>

removing the `tls.certResolver` from all routers, and placing it into the cmdline arguments into the entrypoint solved my problem, thank you