How does Traefik refresh an expired tailscale cert?

Traefik Traefik v3 (latest)
1

Hello,

In the Traefik docs, it says for automatic renewals that "Traefik automatically tracks the expiry date of each Tailscale certificate it fetches, and starts to renew a certificate 14 days before its expiry to match Tailscale daemon renew policy."

How does this work exactly? Will Traefik run some sort of internal cronjob that checks the expiration and updates the certs when needed? Does it update the cert when you access the domain? So if nobody accesses the domain, it may never update the certificate? I'm asking because there is not much information about it. Thanks.

2

My understanding from the doc is, that Traefik will connect to tailscale server (similar to other certResolvers like LetsEncrypt) to fetch a xx.yy.ts.net domain TLS cert for the router rule used domain.

Traefik fetches the cert, it has its data, it serves the cert for matching requests, and will automatically renew it. Not sure if this is checked internally every minute, hour or day. But you don’t need to access the service for it to work.