Own Certificate - tls: no certificates configured - ERR_SSL_UNRECOGNIZED_NAME_ALERT

Traefik Traefik v3 (latest)
1

Hi I am new to traefik. Firstly here is my docker compose file I use in my local portainer.I was experimenting nginx proxy manager and traefik and My crt and key were working with nginx proxy manager also I can see the dashboard of the traefik.

Also here is the error shown in the browser

ERR_SSL_UNRECOGNIZED_NAME_ALERT

docker-compose

services:
  traefik:
    container_name: traefik
    image: traefik:latest
    restart: unless-stopped
    ports:
      # The HTTP port
      - "80:80"
      # The HTTPS port
      - "443:443"
      # The Traefik port
      - "8080:8080"
    networks:
      - proxy
    volumes:
      - /home/traefik/:/etc/traefik/
      - /home/traefik/conf:/etc/traefik/conf/
      - /home/traefik/certs:/etc/traefik/certs/
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock:ro
networks:
  proxy:

/home/traefik/dynamic_conf.yaml

tls:
  certificates:
    - certFile: /etc/traefik/cert.crt
      keyFile: /etc/traefik/cert.key
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/cert.crt
        keyFile: /etc/traefik/cert.key

/home/traefik/traefik.yaml

global:
  checkNewVersion: false
  sendAnonymousUsage: false

log:
  level: DEBUG
  format: common

accessLog:
  format: common

api:
  dashboard: true
  insecure: true

entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: :443

providers:
  docker:
    exposedByDefault: false
  file:
    directory: /etc/traefik
    watch: true

For Test Purposes I was trying nginx then I want to do it with portainer

services:
  nginx:
    container_name: nginx
    image: nginx:latest
    networks:
      - traefik_proxy
    labels:
      - traefik.enable=true
      - traefik.http.routers.nginx.entrypoints=websecure
      - traefik.http.routers.nginx.tls={}
      - traefik.http.routers.nginx.rule=Host(`example.host.com`)
      - traefik.http.routers.nginx.service=nginx
      - traefik.http.services.nginx.loadbalancer.server.port=80
networks:
  traefik_proxy:
    external: true

Location of the certification files -> /home/traefik/certs

Logs

2024-12-20T16:48:49Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "example.host.com"
2024-12-20T16:48:49Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "example.host.com"
2024-12-20T16:48:49Z DBG log/log.go:245 > http: TLS handshake error from my-ip:4851: tls: no certificates configured
2024-12-20T16:48:49Z DBG log/log.go:245 > http: TLS handshake error from my-ip:4047: tls: no certificates configured
2

When checking the cert in the browser, you should see it has a Traefik name, as it was custom created.

When you check the Traefik debug log, you should see an error loading the certs from the dynamic config file on startup, as it seems the path in files is wrong, missing /certs, where the bind mount is.

Note that you should not use latest, as the whole setup could break with a major v4 release, rather pin the major version using v3.

1 Like
3

Thank you for your reply!

You are right I did not see the error log above also I pinned the version to v3.

2024-12-21T12:11:07Z ERR github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:113 > Unable to append certificate /etc/traefik/chained.crt to store error="unable to generate TLS certificate : tls: failed to find any PEM data in certificate input" tlsStoreName=default
2024-12-21T12:11:07Z ERR github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:138 > Error while creating certificate store error="failed to load X509 key pair: tls: failed to find any PEM data in certificate input" tlsStoreName=default

I will check my certificate.

4

The thing is I will generate my certificates again but does anybody know what traefik wants as certificates? If my question sounds nonsense I am a newbie about certificates. Thanks

5 
openssl pkcs12 -in filename.pfx -nocerts -out filename.key

openssl pkcs12 -in filename.pfx -clcerts -nokeys -out filename.crt

I am trying these but still the same error should I create a new post?

Thanks

6

You are aware that the browser will usually check the domain name with the cert?

And the browser will usually require a signed cert from a cert authority or you must import the generated cert public keychain into browser or OS.

7

Yes I am aware of these also my pfx file is valid as I mentioned above my earlier crt and key files were working with nginx proxy manager.

Thanks