# SSL certificate not working for a service using Traefik in Docker Swarm **URL:** \ **Category:** Traefik v2\ **Tags:** docker-swarm\ **Created:** [January 22, 2025, 10:06am UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187 "2025-01-22T10:06:57Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![JoaoPasserini](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@JoaoPasserini](https://community.traefik.io/u/JoaoPasserini)\ **Post date:** [January 22, 2025, 10:06am UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/1 "2025-01-22T10:06:57Z")
Hello, I'm experiencing an issue where my Traefik setup is not generating a Let's Encrypt SSL certificate for one of my services. Instead, it uses the default "Traefik Default Cert". My setup includes: **VPS:** Hetzner **Service Management:** Portainer **Proxy:** Traefik v2.11 in Docker Swarm mode **DNS Management:** Cloudflare (proxy disabled for the domain) Here are the key points: 1. The service is accessible through the domain, but only with the "Traefik Default Cert". 2. I verified the labels for the service: ```auto - traefik.enable=true - traefik.http.routers.service.rule=Host(`example.com`) - traefik.http.routers.service.entrypoints=websecure - traefik.http.routers.service.tls.certresolver=le - traefik.http.services.service.loadbalancer.server.port=80 ``` 1. The file `acme.json` is present and has `600` permissions. 2. DNS is correctly configured, pointing to the VPS IP. Ports 80 and 443 are open. 3. Other services on the same setup successfully use Let's Encrypt certificates. Logs from Traefik do not show clear errors, and I'm unsure what is blocking the certificate issuance. What could I be missing or misconfiguring? Any suggestions would be highly appreciated. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [January 22, 2025, 10:36am UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/2 "2025-01-22T10:36:35Z")
You mentioned Docker Swarm. Traefik Community Edition is not LetsEncrypt cluster-enabled. If you have multiple Traefik instances, you need to use `dnsChallenge` and will get individual TLS certs for each server. Enable and check Traefik debug log ([doc](https://doc.traefik.io/traefik/observability/logs/#level)) and Traefik access log in JSON format ([doc](https://doc.traefik.io/traefik/observability/access-logs/#format)). For TLS issues, search for error and/or acme. Share your full Traefik static and dynamic config, and `docker-compose.yml` if used. Maybe check [simple Traefik Swarm example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-swarm-traefik-dnschallenge). ---
**Author:** ![JoaoPasserini](https://avatars.discourse-cdn.com/v4/letter/j/f6c823/32.png) [@JoaoPasserini](https://community.traefik.io/u/JoaoPasserini)\ **Post date:** [January 22, 2025, 10:46am UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/3 "2025-01-22T10:46:40Z")
Hello, I just solved the problem with another solution, thank you very much for your response. ---
**Author:** ![artyom2032](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@artyom2032](https://community.traefik.io/u/artyom2032)\ **Post date:** [July 25, 2026, 5:31pm UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/4 "2026-07-25T17:31:58Z")
Hello, could you please share the solution that worked for you? I'm facing a similar issue with my own setup. I'm trying to use traefik as a swarm service on a dedicated host in my home network to discover compose services across other machines through an overlay network. Services are detected and the traefik web interface shows them as routers, certs are even generated apparently, but when accessing my services through the domain address the default cert is still used. Traefik shows no errors. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 25, 2026, 8:05pm UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/5 "2026-07-25T20:05:40Z")
Check [Docker Swarm Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-swarm-traefik) and [the one with dnsChallenge](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-swarm-traefik-dnschallenge). ---
**Author:** ![artyom2032](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@artyom2032](https://community.traefik.io/u/artyom2032)\ **Post date:** [July 25, 2026, 8:32pm UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/6 "2026-07-25T20:32:29Z")
Thanks for your reply! I've actually been dissecting your github example for days now XD My problem is that it doesn't show how to discover a service from _outside_ the traefik host, which to me is the whole point of migrating from a docker compose to a swarm architecture. In your example, you deploy a sample whoami service on the very same stack and host as traefik, but what if the deployed service is within a _compose_ stack (connected to the overlay network) on a _different_ host initialized as a worker node (→ `docker stack deploy` not available)? Surely this should be possible, it's a simple enough paradigm : a centralized traefik proxy to discover services from compose stacks across isolated nodes through an overlay network and reroute incoming HTTPS, but so far I found no documentation covering that specific use case. Here's my diagram if that can help clarify what I want to achieve : [Reverse proxy - Album on Imgur](https://imgur.com/a/reverse-proxy-o55gBHJ) ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 26, 2026, 12:10pm UTC](https://community.traefik.io/t/ssl-certificate-not-working-for-a-service-using-traefik-in-docker-swarm/26187/7 "2026-07-26T12:10:14Z")
Can’t view the image on the external ad overloaded site. Docker Swarm uses `services` that are run across nodes. You can create a `service` via CLI, without `stack deploy`. `providers.swarm` will only recognizes services, not individual containers, will only work on Swarm manager nodes. When using `providers.docker`, Traefik needs to be on the same node as the target container. So Traefik can not auto-discover plain Docker containers on a different node.