# Letsencrypt + Own certificates can't get it work

**URL:** <https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, file, docker\
**Created:** [January 14, 2023, 10:57am UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138 "2023-01-14T10:57:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pavel](https://avatars.discourse-cdn.com/v4/letter/p/a4c791/32.png) [@Pavel](https://community.traefik.io/u/Pavel)\
**Post date:** [January 14, 2023, 10:57am UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138/1 "2023-01-14T10:57:13Z")

</div>

Hello!

Can someone please help to solve problem.  
We using letsencrypt certificates, but for some sites we need to use wildcard certificate.

Letsencrypt section defined in static config:

```auto
certificatesResolvers:
  crl:
    acme:
      email: х@х
      storage: acme.json
      httpChallenge:
        entrypoint: web

```

.cert and .key placed into docker container with chmod 600:

```auto
      - ./data/certs/:/etc/certs/

```

dynamic configuration folder mapped

```auto
      - ./data/configuration/:/configuration/

```

Ive created file for certs /configuration/certificates.yml

```auto
tls:
  certificates:
    # x
    - certFile: /etc/certs/x.cert
      keyFile: /etc/certs/x.key

```

in dynamic config for letsencrypt we using:

```auto
http:
 #region routers 
  routers:
    sx.x:
      rule: Host(`sx.x`)
      middlewares:
        - internet
      tls:
        certResolver: crl
      service: sx.x

tls:
  options:
    default:
      minVersion: VersionTLS12
      sniStrict: true
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 # TLS 1.2
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 # TLS 1.2
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 # TLS 1.2
        - TLS_AES_256_GCM_SHA384 # TLS 1.3
        - TLS_CHACHA20_POLY1305_SHA256 # TLS 1.3
        - TLS_FALLBACK_SCSV # TLS FALLBACK
      curvePreferences:
        - secp521r1
        - secp384r1
    modern:
      minVersion: VersionTLS13

```

and i totaly dont uderstand how i can tell traefik to use our certificate for some of our services. what need to be defined?

Thank you

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 14, 2023, 12:34pm UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138/2 "2023-01-14T12:34:28Z")

</div>

You can use Traefik with custom cert and LetsEncrypt at the same time.

Define a LetsEncrypt `certresolver` and use a `provider.file` in the static config to load a dynamic config with the custom TLS certs. Then in the routers assign the certresolver for LE certs and just use TLS=true for the custom certs.

```auto
# traefik.yml - Traefik static config
entryPoints:
  ...

providers:
  file:
    filename: /traefik-dynamic.yml
    watch: true

certificatesResolvers:
  myresolver:
    acme:
      email: your-email@example.com
      storage: /acme.json
      tlsChallenge:
        entryPoint: websecure

```

```auto
# traefik-dynamic.yml - Traefik dynamic config
tls:
  options:
    default:
      minVersion: VersionTLS12
  certificates:
    - certFile: /run/secrets/example.com.crt
      keyFile: /run/secrets/example.com.key
  stores: # add this if you want to set default cert for unknown hosts
    default:
      defaultCertificate:
        certFile: /run/secrets/example.com.crt
        keyFile: /run/secrets/example.com.key

```

```auto
# docker-compose.yml with labels for provider.docker
services:
  whoami-with-custom-cert:
    image: traefik/whoami:v1.8
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.entrypoints=websecure
      - traefik.http.routers.mywhoami.rule=Host(`example.com`)
      - traefik.http.routers.mywhoami.tls=true
      - traefik.http.services.mywhoami.loadbalancer.server.port=80

  whoami-with-letsencrypt-cert:
    image: traefik/whoami:v1.8
    networks:
      - proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.mywhoami.entrypoints=websecure
      - traefik.http.routers.mywhoami.rule=Host(`example2.com`)
      - traefik.http.routers.mywhoami.tls.certresolver=myresolver
      - traefik.http.services.mywhoami.loadbalancer.server.port=80

```

---

<div class="post-metadata">

**Author:** ![Pavel](https://avatars.discourse-cdn.com/v4/letter/p/a4c791/32.png) [@Pavel](https://community.traefik.io/u/Pavel)\
**Post date:** [January 14, 2023, 1:02pm UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138/3 "2023-01-14T13:02:06Z")

</div>

Thank you! But how i can define tls=true if im using external service, like

```auto
    x.x.com
      rule: Host(`x.x.com`)
      service: x.x.com
	  
    x.x.com:
      loadBalancer:
        servers:
          - url: "http://10.15.103.75:9000"
        passHostHeader: true

```

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [January 14, 2023, 2:12pm UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138/4 "2023-01-14T14:12:11Z")

</div>

> [@Pavel](#):
>
> ```auto
> http:
> #region routers 
> routers:
> sx.x:
> rule: Host(`sx.x`)
> middlewares:
> - internet
> tls:
> certResolver: crl
> service: sx.x
> 
> ```

In config file you use this for `true`:

```auto
tls: {}

```

---

<div class="post-metadata">

**Author:** ![Pavel](https://avatars.discourse-cdn.com/v4/letter/p/a4c791/32.png) [@Pavel](https://community.traefik.io/u/Pavel)\
**Post date:** [January 14, 2023, 3:12pm UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138/5 "2023-01-14T15:12:38Z")

</div>

Thank you!

Have a nice day

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [January 17, 2023, 3:12pm UTC](https://community.traefik.io/t/letsencrypt-own-certificates-cant-get-it-work/17138/6 "2023-01-17T15:12:39Z")

</div>

Closed on January 17, 2023, 3:12pm UTC

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.