Hello,
I'm experiencing an issue where my Traefik setup is not generating a Let's Encrypt SSL certificate for one of my services. Instead, it uses the default "Traefik Default Cert". My setup includes:
VPS: Hetzner
Service Management: Portainer
Proxy: Traefik v2.11 in Docker Swarm mode
DNS Management: Cloudflare (proxy disabled for the domain)
Here are the key points:
- The service is accessible through the domain, but only with the "Traefik Default Cert".
- I verified the labels for the service:
- traefik.enable=true
- traefik.http.routers.service.rule=Host(`example.com`)
- traefik.http.routers.service.entrypoints=websecure
- traefik.http.routers.service.tls.certresolver=le
- traefik.http.services.service.loadbalancer.server.port=80
- The file
acme.json is present and has 600 permissions.
- DNS is correctly configured, pointing to the VPS IP. Ports 80 and 443 are open.
- Other services on the same setup successfully use Let's Encrypt certificates.
Logs from Traefik do not show clear errors, and I'm unsure what is blocking the certificate issuance.
What could I be missing or misconfiguring? Any suggestions would be highly appreciated.
You mentioned Docker Swarm. Traefik Community Edition is not LetsEncrypt cluster-enabled. If you have multiple Traefik instances, you need to use dnsChallenge and will get individual TLS certs for each server.
Enable and check Traefik debug log (doc) and Traefik access log in JSON format (doc). For TLS issues, search for error and/or acme.
Share your full Traefik static and dynamic config, and docker-compose.yml if used.
Maybe check simple Traefik Swarm example.
Hello, I just solved the problem with another solution, thank you very much for your response.
Hello, could you please share the solution that worked for you? I'm facing a similar issue with my own setup. I'm trying to use traefik as a swarm service on a dedicated host in my home network to discover compose services across other machines through an overlay network. Services are detected and the traefik web interface shows them as routers, certs are even generated apparently, but when accessing my services through the domain address the default cert is still used. Traefik shows no errors.
Thanks for your reply! I've actually been dissecting your github example for days now XD
My problem is that it doesn't show how to discover a service from outside the traefik host, which to me is the whole point of migrating from a docker compose to a swarm architecture. In your example, you deploy a sample whoami service on the very same stack and host as traefik, but what if the deployed service is within a compose stack (connected to the overlay network) on a different host initialized as a worker node (→ docker stack deploy not available)? Surely this should be possible, it's a simple enough paradigm : a centralized traefik proxy to discover services from compose stacks across isolated nodes through an overlay network and reroute incoming HTTPS, but so far I found no documentation covering that specific use case.
Here's my diagram if that can help clarify what I want to achieve : Reverse proxy - Album on Imgur
Can’t view the image on the external ad overloaded site.
Docker Swarm uses services that are run across nodes. You can create a service via CLI, without stack deploy.
providers.swarm will only recognizes services, not individual containers, will only work on Swarm manager nodes.
When using providers.docker, Traefik needs to be on the same node as the target container.
So Traefik can not auto-discover plain Docker containers on a different node.