# Self Signed Certificates Not Working

**URL:** <https://community.traefik.io/t/self-signed-certificates-not-working/29353>\
**Category:** Traefik v3 (latest)\
**Tags:** docker\
**Created:** [November 26, 2025, 5:21am UTC](https://community.traefik.io/t/self-signed-certificates-not-working/29353 "2025-11-26T05:21:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![monorail073](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@monorail073](https://community.traefik.io/u/monorail073)\
**Post date:** [November 26, 2025, 5:21am UTC](https://community.traefik.io/t/self-signed-certificates-not-working/29353/1 "2025-11-26T05:21:39Z")

</div>

Hey everyone,

I have been using Traefik for quite some time now with a custom domain. However, this domain is getting expensive and for now I’m switching to a self signed domain.

I was following some tutorials and this is what I’ve done:

Created my certificates using

```auto
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout certs/selfsigned.key -out certs/selfsigned.crt -subj "/CN=home.lan"

```

and pointed home.lan to the IP of the VM running traefik. Put the certificates inside a /certs folder and updated docker-compose.yml:

```auto
traefik:
    container_name: traefik
    image: traefik:latest
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - traefik
    ports:
      - 80:80
      - 8080:8080
      - 443:443
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./certs:/certs
      - ./config/traefik.yml:/traefik.yml:ro
      - ./config/acme.json:/acme.json
      - ./config/local.json:/local.json
      - ./config/config.yml:/config.yml:ro
      - ./config/traefik.log:/traefik.log

```

Simplified version of config.yml

```auto
http:
  routers:
    test:
      entryPoints:
        - "https"
      rule: "Host(`home.lan`)"
      service: test
  services:
    test:
      loadBalancer:
        servers:
          - url: <redacted>

```

traefik.yml

```auto
api:
  dashboard: true
  debug: true

entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
  https:
    address: ":443"

serversTransport:
  insecureSkipVerify: true

log:
  filePath: "/traefik.log"
  level: DEBUG

providers:
  docker:
    endpoint: <redacted>
    exposedByDefault: false
  file:
    filename: /config.yml

tls:
  certificates:
    - certFile: /certs/selfsigned.crt
      keyFile: /certs/selfsigned.key
      stores:
        - default

certificatesResolvers:
  local:
    acme:
      tlschallenge: true
      email: a@example.com
      storage: local.json

```

I also installed the custom certificate on my computer and phone, and in both I get an insecure error. Looking at the traefik logs I see:

```auto
2025-11-25T22:20:04Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:288 > Serving default certificate for request: "home.lan"
2025-11-25T22:20:04Z DBG log/log.go:245 > http: TLS handshake error from 172.30.92.1:49735: remote error: tls: unknown certificate

```

I tried looking in the forums, YouTube, Google, ChatGPT and none of the solutions seem to work, I always get this result.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 26, 2025, 5:27am UTC](https://community.traefik.io/t/self-signed-certificates-not-working/29353/2 "2025-11-26T05:27:26Z")

</div>

For a custom TLS cert to work in Traefik, you need a TLS cert with a matching common name, it needs to be loaded in dynamic config file, which is loaded via `providers.file`. Then you need to enable TLS on `entrypoint` or `router` (yaml: `tls: {}`, labels: `tls=true`).

Note that also a `certResolver` needs to be assigned to `entrypoint` or `router` to be used by Traefik.

---

<div class="post-metadata">

**Author:** ![monorail073](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@monorail073](https://community.traefik.io/u/monorail073)\
**Post date:** [November 26, 2025, 8:05pm UTC](https://community.traefik.io/t/self-signed-certificates-not-working/29353/3 "2025-11-26T20:05:18Z")

</div>

I added tls: {} to my entrypoint and the certResolver as follows:

```auto
entryPoints:
  http:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: https
          scheme: https
  https:
    address: ":443"
    http:
      tls: 
        certResolver: local

```

This did not do anything, I am still getting the “serving default certificate”. Also, how do I add the certificate to the dynamic config file? The docs mention that that’s for services, routers and middlewares.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [November 27, 2025, 6:57am UTC](https://community.traefik.io/t/self-signed-certificates-not-working/29353/4 "2025-11-27T06:57:46Z")

</div>

Currently we are blind, how about you enable Traefik debug log ([doc](https://doc.traefik.io/traefik/reference/install-configuration/observability/logs-and-accesslogs/)) and check for err, tls, acme.

This piece is dynamic config and needs to go in a separate file, which needs to be loaded in static config via `providers.file` ([doc](https://doc.traefik.io/traefik/reference/install-configuration/providers/others/file/), [issue](https://github.com/traefik/traefik/issues/12098)):

```auto
tls:
  certificates:
    - certFile: /certs/selfsigned.crt
      keyFile: /certs/selfsigned.key

```

---

<div class="post-metadata">

**Author:** ![monorail073](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@monorail073](https://community.traefik.io/u/monorail073)\
**Post date:** [November 30, 2025, 11:07am UTC](https://community.traefik.io/t/self-signed-certificates-not-working/29353/5 "2025-11-30T11:07:40Z")

</div>

The problem with my configuration was disabling the dns challenge in my provider. Eventually it worked. However, so many challenges came after that I abandoned the idea of a self signed certificate. It’s just too complicated for Docker.

Anyways, for any people in the future struggling with this, try disabling the DNS challenge. Thank you for all the help!