Set custom certificate for entire entrypoint

Traefik Traefik v2 (latest)
1

Hi,
I have an existing self-signed root certificate and want to use it for an entire entrypoint. My routers and services are mainly configured by docker labels and I have a static YAML config.

I have found multiple syntax for specifying the certificate, but none of them seem to work.

Can someone give an example YAML config for

2

I got TLS working now, but as soon as I use the https endpoint it gives me a 404 Error (over HTTPS)

This is my static config:

serversTransport:
  insecureSkipVerify: true

entryPoints:
  # Not used in apps, but redirect everything from HTTP to HTTPS
  web:
    address: :80

  websecure:
    address: :443
    http:
      tls: {}

providers:
  # File provider for connecting things that are outside of docker / defining middleware
  file:
    filename: /etc/traefik/fileconfig.yml
    watch: true

  docker:
    network: traefik
    exposedByDefault: false

# Enable traefik ui
api:
  dashboard: true
  insecure: true

# Log level INFO|DEBUG|ERROR
log:
  level: DEBUG

Dynamic config:

tls:
  stores:
    default:
      defaultCertificate:
        certFile: /certs/root.crt
        keyFile: /certs/root.key
  # certificates:
  #   - certFile: /certs/root.crt
  #     keyFile: /certs/root.key
  #     stores:
  #       - default
http:
  routers:
    openhab:
      entryPoints:
        - web
      rule: "Host(`openhab.sweet`) || Host(`openhab.bigmac.sweet`)"
      service: openhab

  services:
    openhab:
      loadBalancer:
        servers:
          - url: http://192.168.178.33:8080/

Labels on container:

          traefik.enable: "true"
          traefik.http.routers.authelia.rule: "Host(`auth.bigmac.sweet`)"
          traefik.http.routers.authelia.entrypoints: "websecure"
3

If its the openhab.sweet or openhab.bigmac.sweet hosts then there is no matching router so you get a 404.
FYI Host takes a list so you can collapse that rule to Host(`openhab.sweet`,`openhab.bigmac.sweet`)

The openhab router is configured to use the web entrypoint, changing that to websecure should see your requests going through.