# Lets Encrypt AND self signed certificates

**URL:** <https://community.traefik.io/t/lets-encrypt-and-self-signed-certificates/3100>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme\
**Created:** [November 23, 2019, 5:42pm UTC](https://community.traefik.io/t/lets-encrypt-and-self-signed-certificates/3100 "2019-11-23T17:42:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![grasshide](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/grasshide/32/5214_2.png) [@grasshide](https://community.traefik.io/u/grasshide)\
**Post date:** [November 23, 2019, 5:42pm UTC](https://community.traefik.io/t/lets-encrypt-and-self-signed-certificates/3100/1 "2019-11-23T17:42:47Z")

</div>

My server is hosting services for the internet as well as some small services for the local network. So far I was able to secure the external services with Lets Encrypt. To improve security on my internal services (LAN only) I want to introduce TLS with self signed certificates.

I don't get the TLS to work with the self signed certificate. I simply don't see where I bind my docker to the self signed certificate.

The container I want to use a self signed certificate:

```auto
services:
  dokuwiki:
    build: ./dokuwiki
    container_name: dokuwiki
    labels:
      - traefik.enable=true
      - traefik.http.routers.dokuwiki.entrypoints=internal
      - traefik.http.routers.dokuwiki.rule=Host(`servername.localdomain`)
      - traefik.http.routers.dokuwiki.tls=true
      # what do I use here to tell traefik to use the self signed certificate?!?
 
traefik:
    image: traefik
    container_name: traefik
    ports:
      - "80:80"
      - "443:443"
      - "8011:8080" 
      - "8642:8642" # the port where I want to use the self signed certificate 
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro 
      - ./traefik.toml:/traefik.toml
      - ./rules.toml:/rules.toml
      - ./acme.json:/acme.json
      - ./certs:/certs

```

traefik.toml:

```auto
[entryPoints]
  [entryPoints.http]
    address = ":80"
  [entryPoints.https]
    address = ":443"
  [entryPoints.internal]
    address = ":8642" # the port where I want to use the self signed certificate 

...

[certificatesResolvers]
  [certificatesResolvers.default]
    [certificatesResolvers.default.acme]
      email = "my-email@foo.bar"
      storage = "acme.json"
      [certificatesResolvers.default.acme.tlsChallenge]

[[tls.certificates]] # the self signed certificate 
  certFile = "/certs/localdomain.crt"
  keyFile = "/certs/localdomain.key"

```

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [November 23, 2019, 6:39pm UTC](https://community.traefik.io/t/lets-encrypt-and-self-signed-certificates/3100/2 "2019-11-23T18:39:42Z")

</div>

Hello,

the `tls` section is a part of dynamic configuration: [https://docs.traefik.io/v2.0/https/tls/#user-defined](https://docs.traefik.io/v2.0/https/tls/#user-defined)

So you have to create a dedicated file for that.

---

<div class="post-metadata">

**Author:** ![grasshide](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/grasshide/32/5214_2.png) [@grasshide](https://community.traefik.io/u/grasshide)\
**Post date:** [November 24, 2019, 4:08pm UTC](https://community.traefik.io/t/lets-encrypt-and-self-signed-certificates/3100/3 "2019-11-24T16:08:46Z")

</div>

Thanks, that really worked!

But how does traefik know which certificate to use? How does that work if there is more than one self signed certificate? Does it evaluate the common name (CN)?

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [March 2, 2021, 10:13pm UTC](https://community.traefik.io/t/lets-encrypt-and-self-signed-certificates/3100/5 "2021-03-02T22:13:25Z")

</div>

Closed on March 2, 2021, 10:13pm UTC