# HA with etcd backed certs in swarm

**URL:** <https://community.traefik.io/t/ha-with-etcd-backed-certs-in-swarm/26616>\
**Category:** Traefik v3 (latest)\
**Tags:** kv, letsencrypt-acme, docker-swarm\
**Created:** [February 23, 2025, 1:41pm UTC](https://community.traefik.io/t/ha-with-etcd-backed-certs-in-swarm/26616 "2025-02-23T13:41:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karmicjuju](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/karmicjuju/32/10026_2.png) [@Karmicjuju](https://community.traefik.io/u/Karmicjuju)\
**Post date:** [February 23, 2025, 1:41pm UTC](https://community.traefik.io/t/ha-with-etcd-backed-certs-in-swarm/26616/1 "2025-02-23T13:41:15Z")

</div>

Running a Swarm cluster and v3 as a global service.  
When I set the cert storage to a file, i get a successful challenge. However, pointing to etcd endpoints returns

```auto
unable to get ACME account: open etcd://192.168.7.200:2379,192.168.7.201:2379,192.168.7.202:2379/traefik/acme.json: no such file or directory

```

my config is as so:

```auto
global:
  checkNewVersion: true
  sendAnonymousUsage: false

log:
  level: DEBUG

accesslog: {}

entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
  web-external:
    address: ":81"
    http:
      redirections:
        entryPoint:
          to: websecure-external
          scheme: https
  websecure-external:
    address: ":444"
certificatesResolvers:
  cloudflare:
    acme:
    email: ##### OMITED FOR PRIVACY #####
      storage: "etcd://192.168.7.200:2379,192.168.7.201:2379,92.168.7.202:2379/traefik/acme.json"
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1"
          - "8.8.8.8"

providers:
  swarm:
    exposedByDefault: false
    network: service-net
  file:
    directory: /etc/traefik
    watch: true

```

For trouble shooting purposes I have attatched to the container and can successfully read and write directly to all the etcd nodes

Is this not actually supported or did I miss something in my traefik.yaml?

After spending a few days on this I even tried conul, but I recieved the same error and conditions. File works fine.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 23, 2025, 2:13pm UTC](https://community.traefik.io/t/ha-with-etcd-backed-certs-in-swarm/26616/2 "2025-02-23T14:13:06Z")

</div>

Are you using Traefik EE? Traefik CE (Community Edition) does not allow distributed LetsEncrypt, AFAIK.

---

<div class="post-metadata">

**Author:** ![Karmicjuju](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/karmicjuju/32/10026_2.png) [@Karmicjuju](https://community.traefik.io/u/Karmicjuju)\
**Post date:** [February 23, 2025, 3:45pm UTC](https://community.traefik.io/t/ha-with-etcd-backed-certs-in-swarm/26616/3 "2025-02-23T15:45:12Z")

</div>

I am using CE. I didn’t know this functionality was exclusive to EE. I thought the distributed storage was supported, just not the coordination. I was under the assumption that it would just differ the management of the certificate file to the kv store.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [February 24, 2025, 6:05am UTC](https://community.traefik.io/t/ha-with-etcd-backed-certs-in-swarm/26616/4 "2025-02-24T06:05:13Z")

</div>

At least the Traefik website ([link](https://doc.traefik.io/traefik-enterprise/tls/distributed-acme/)) states distributed LetsEncrypt only works with Traefik EE. Devs somehow got to be paid.

You can use up to 5 servers in Swarm with `dnsChallenge` for individual TLS certs.

Or use LE outside of Traefik and load the certs, like [post](https://community.traefik.io/t/using-certbot-to-manage-certs-independently-from-traefik-possible/16199/), [post](https://community.traefik.io/t/docker-swarm-global-proxy-and-lets-encrypt/17663/).

With k8s cert-manager, the distributed LetsEncrypt works with open-source Traefik.