# How do I serve a LetsEncrypt certificate for requests lacking SNI?

**URL:** <https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [January 5, 2024, 6:28pm UTC](https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989 "2024-01-05T18:28:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tecywiz121](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tecywiz121/32/8063_2.png) [@tecywiz121](https://community.traefik.io/u/tecywiz121)\
**Post date:** [January 5, 2024, 6:28pm UTC](https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989/1 "2024-01-05T18:28:52Z")

</div>

I'm setting up a little home server using docker compose, and I'm using traefik to terminate my SSL connections/request certificates from Let's Encrypt. For the most part, this is working great, so thanks for building this!

One client does not send SNI when making the connection to my traefik container. Don't ask me why, I'm not sure. What I'd like to do is have Traefik default to the `example.com` certificate when it receives a request without SNI, instead of the Traefik default certificate.

The documentation suggests [`defaultGeneratedCert`](https://doc.traefik.io/traefik/https/tls/#acme-default-certificate), but I can't figure out where to put the labels in my `docker-compose.yml`.

Here's what I have so far:

```yaml
services:
  reverse-proxy:
    # The official v2 Traefik docker image
    image: traefik:v2.10
    restart: unless-stopped
    # Enables the web UI and tells Traefik to listen to docker
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      #- "--certificatesresolvers.myresolver.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.myresolver.acme.email=postmaster@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--log.level=DEBUG"
    labels:
      - "traefik.tls.stores.default.defaultgeneratedcert.resolver=myresolver"
      - "traefik.tls.stores.default.defaultgeneratedcert.domain.main=example.com"
      - traefik.http.routers.traefik-secure.tls=true
      - traefik.http.routers.traefik-secure.tls.domains[0].main=example.com
      - "traefik.http.routers.traefik-secure.tls.certresolver=myresolver"
      - traefik.enable=true
    ports:
      # The HTTP port
      - "443:443"
      - "80:80"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik/files:/letsencrypt

```

Thanks for any help!

Similar topics I've read:

- [Automatic subdomain letsencrypt certificates with wildcard fallback for non-SNI](https://community.traefik.io/t/automatic-subdomain-letsencrypt-certificates-with-wildcard-fallback-for-non-sni/11959)
- [Default certificate from letsencrypt](https://community.traefik.io/t/default-certificate-from-letsencrypt/11697)

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 6, 2024, 11:53am UTC](https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989/2 "2024-01-06T11:53:24Z")

</div>

Check ACME Default Cert ([doc](https://doc.traefik.io/traefik/https/tls/#acme-default-certificate)).

---

<div class="post-metadata">

**Author:** ![tecywiz121](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tecywiz121/32/8063_2.png) [@tecywiz121](https://community.traefik.io/u/tecywiz121)\
**Post date:** [January 6, 2024, 3:59pm UTC](https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989/3 "2024-01-06T15:59:26Z")

</div>

Yep! That's where I started. You'll note that I've added those labels to my `docker-compose.yml` file:

> [@tecywiz121](#):
>
> ```auto
> labels:
> - "traefik.tls.stores.default.defaultgeneratedcert.resolver=myresolver"
> - "traefik.tls.stores.default.defaultgeneratedcert.domain.main=example.com"
> 
> ```

They just don't seem to do anything. I'm assuming I have them in the wrong place?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 6, 2024, 6:40pm UTC](https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989/4 "2024-01-06T18:40:02Z")

</div>

Looks according to doc:

```auto
## Dynamic configuration
labels:
  - "traefik.tls.stores.default.defaultgeneratedcert.resolver=myresolver"
  - "traefik.tls.stores.default.defaultgeneratedcert.domain.main=example.org"
  - "traefik.tls.stores.default.defaultgeneratedcert.domain.sans=foo.example.org, bar.example.org"

```

Do you get LE certs at all?

---

<div class="post-metadata">

**Author:** ![tecywiz121](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tecywiz121/32/8063_2.png) [@tecywiz121](https://community.traefik.io/u/tecywiz121)\
**Post date:** [January 6, 2024, 6:55pm UTC](https://community.traefik.io/t/how-do-i-serve-a-letsencrypt-certificate-for-requests-lacking-sni/20989/5 "2024-01-06T18:55:35Z")

</div>

> [@bluepuma77](#):
>
> Do you get LE certs at all?

Yep! My other containers get LE certs.