I’ve been using traefik for a few years now, but a few days ago, I ran into a very weird behaviour.
We switched our DNS provider, so we had to change our config in traefik accordingly. Everything worked fine and in addition to the old acme-oldprovider.json a new file acme-newprovider.json appeared with the new certificate. A quick look at the application showed the new cert in the browser, so traefik picked it up correctly.
This was weeks ago.
Now a few days ago a check on our frontend raised an alarm “Cert will expire soon <14 days”.
That made me suspicious. Triggering multiple curl requests and browser sessions I was able to catch it. Sometimes the valid new cert is served. But sometimes an old one is served? How odd. I digged around a bit, when I realized, that those might be the old certificates. I dumped the old file using the amazing traefik-certs-dumper and was able to confirm what I assumed earlier - it where in fact the old certs. After I removed the old files and restarted traefik, the issues seems fixed.
Now I wonder, why would traefik pick up an old cert from a file different than the one specified in the cert resolver? Does it by default search in all files in the designated path?
Maybe someone can clear up the confusion here. Maybe it was some sort of caching and hat nothing to do with my assumption? But who knows.
Kind Regards,
Leo 