# Portainer behind Traefik - Bad certificate - insecureSkipVerify: true does not kick in?

**URL:** <https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [March 13, 2024, 9:20am UTC](https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848 "2024-03-13T09:20:21Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![Dal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dal/32/8363_2.png) [@Dal](https://community.traefik.io/u/Dal)\
**Post date:** [March 16, 2024, 7:40pm UTC](https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848/22 "2024-03-16T19:40:23Z")

</div>

It came as a pfx file, and I split it into 3 parts: key, cert and ca.  
What should I have done then?

Thanks again

---

<div class="post-metadata">

**Author:** ![Dal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dal/32/8363_2.png) [@Dal](https://community.traefik.io/u/Dal)\
**Post date:** [March 17, 2024, 8:53am UTC](https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848/23 "2024-03-17T08:53:06Z")

</div>

BTW:  
This is the certificate authority I need to get installed:  
[https://ssl-tools.net/subjects/f566ab705743b529c622d2077370590733eb80ac](https://ssl-tools.net/subjects/f566ab705743b529c622d2077370590733eb80ac)

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [March 17, 2024, 9:22am UTC](https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848/24 "2024-03-17T09:22:53Z")

</div>

The key file should include a single key. The cert file should usually include 3 certs: 1) server cert (domain), 2) intermediate cert, 3) root cert.

Every cert provider has different naming for the files, so check the docs of your provider, how to create a valid web server cert with the 3 parts.

---

<div class="post-metadata">

**Author:** ![Dal](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/dal/32/8363_2.png) [@Dal](https://community.traefik.io/u/Dal)\
**Post date:** [March 19, 2024, 6:08pm UTC](https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848/25 "2024-03-19T18:08:07Z")

</div>

Finally figured this out by using this command line:

openssl pkcs12 -in cert.pfx -nomacver -nodes -out - | awk '/-----BEGIN/{a=1}/-----END/{print;a=0}a'

This lists all parts in the certificate - including the key - in one giant text string.  
All I had to do was to cut out the key part in one file, and the rest in another file.

Thanks

[Previous page](https://community.traefik.io/t/portainer-behind-traefik-bad-certificate-insecureskipverify-true-does-not-kick-in/21848.md?page=1)