# Traefik Hubs' backend AWS Global Accellerator seems to have a self-signed cert attached to it **URL:** \ **Category:** Traefik Hub\ **Created:** [July 7, 2022, 2:48pm UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028 "2022-07-07T14:48:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![OMG](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@OMG](https://community.traefik.io/u/OMG)\ **Post date:** [July 7, 2022, 2:48pm UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/1 "2022-07-07T14:48:35Z")
Hello, Super happy about the new Traefik Hub for publishing services! I've ran in to an issue: The random-generated FQDN for the service seems to work fine on https:, however the SSL chain fails if you point at that service endpoint as a CNAME from an owned domain. This should be easy to reproduce: - Create a Traefik Hub service - take the random FQDN: [shiny-new.asdfasdf.traefikhub.io](http://shiny-new.asdfasdf.traefikhub.io) - create a CNAME in your owned-domain [newservice.example.com](http://newservice.example.com) -\> [shiny-new.asdfasdf.traefikhub.io](http://shiny-new.asdfasdf.traefikhub.io) - try to navigate to this new service endpoint [https://newservice.example.com](https://newservice.example.com) and you will be presented with a SSL error. Inspecting the certificate presented, it is a self-signed "Traefik default certificate". Digging around a bit, when I ping the FQDN of the traefik-provided DNS name, it resolves to an AWS global accelerator. Cool. That tells me Traefik is using some automation in AWS to build out the ELB endpoint in AWS. The default cert attached to this ELB should be either a LE cert, or perhaps even easier and cheaper for Traefik, just do a DNS-validated \*.lbname.traefikhub.io AWS ACM certificate, and the chain will pass cleanly Hoping for some comments from the Traefik Hub team on this. Thank you, and happy to help troubleshoot if helpful. ---
**Author:** ![OMG](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@OMG](https://community.traefik.io/u/OMG)\ **Post date:** [July 11, 2022, 11:34pm UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/2 "2022-07-11T23:34:40Z")
Bueller...? Bueller? 🦗 ---
**Author:** ![Tiffany](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tiffany/32/4620_2.png) [@Tiffany](https://community.traefik.io/u/Tiffany)\ **Post date:** [July 12, 2022, 12:59am UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/3 "2022-07-12T00:59:39Z")
Hey OMG, the engineering team has seen this and is looking into it. Someone should be back really soon... ---
**Author:** ![nicomengin](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/nicomengin/32/5507_2.png) [@nicomengin](https://community.traefik.io/u/nicomengin)\ **Post date:** [July 12, 2022, 9:27am UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/4 "2022-07-12T09:27:42Z")
Hello OMG, thanks for your feedback and your interest in Traefik Hub. If I understand correctly, you want to publish a service using your own domain instead of the one generated by Traefik Hub. Good news! The team is currently working on this feature and we'll bring it soon. We'll keep you updated as soon as the feature is available. ---
**Author:** ![OMG](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@OMG](https://community.traefik.io/u/OMG)\ **Post date:** [July 12, 2022, 2:47pm UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/5 "2022-07-12T14:47:14Z")
Great, I’m excited to hear that! Please take a look however, because the AWS ELB endpoint is returning a self-signed Traefik cert, which could easily be resolved (I’d suggest using a free AWS ACM cert for \*.{lbname}.traefikhub.io), if that were done, I would be able to point CNAMEs at the Traefik Hub provided FQDNs without issue. ---
**Author:** ![nicomengin](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/nicomengin/32/5507_2.png) [@nicomengin](https://community.traefik.io/u/nicomengin)\ **Post date:** [July 13, 2022, 2:54pm UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/6 "2022-07-13T14:54:47Z")
Hey OMG, I don't think that using a valid certificate instead of the current one allows you to use a CNAME. Indeed, Traefik Hub uses the Host SNI to redirect the traffic. In your use case, it means that it uses `newservice.example.com ` instead of `shiny-new.asdfasdf.traefikhub.io`. As `newservice.example.com ` is not a domain Traefik Hub handles, you won't reach any service. ---
**Author:** ![OMG](https://avatars.discourse-cdn.com/v4/letter/o/9dc877/32.png) [@OMG](https://community.traefik.io/u/OMG)\ **Post date:** [July 13, 2022, 3:28pm UTC](https://community.traefik.io/t/traefik-hubs-backend-aws-global-accellerator-seems-to-have-a-self-signed-cert-attached-to-it/15028/7 "2022-07-13T15:28:28Z")
I see what you're saying. the ELB listener isnt listing for the host header provided by the browser, when I'm providing my own FQDN, so it lands at the default on the match list. That adds up. I'll keep an eye out for the BYO-domain feature availability in the future!