# Traefik in Docker not issuing SSL certificates **URL:** \ **Category:** Traefik v3 (latest)\ **Tags:** docker, letsencrypt-acme\ **Created:** [November 8, 2024, 2:58pm UTC](https://community.traefik.io/t/traefik-in-docker-not-issuing-ssl-certificates/25082 "2024-11-08T14:58:46Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![codingcoffee](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/codingcoffee/32/9535_2.png) [@codingcoffee](https://community.traefik.io/u/codingcoffee)\ **Post date:** [November 8, 2024, 2:58pm UTC](https://community.traefik.io/t/traefik-in-docker-not-issuing-ssl-certificates/25082/1 "2024-11-08T14:58:46Z")
Here's my `docker-compose.yml` ```auto services: traefik: image: "traefik:v3.2.0" volumes: - "./traefik.yml:/etc/traefik/traefik.yml:ro" - "/etc/letsencrypt/:/etc/letsencrypt/" ports: - "80:80" - "443:443" - "8080:8080" ``` Here's my `traefik.yml` ```auto api: dashboard: true insecure: true log: level: DEBUG entryPoints: web: address: ":80" websecure: address: ":443" http: services: special-service: loadBalancer: servers: - url: "http://server-1.xxx.xx:8000" - url: "http://server-2.xxx.xx:8000" healthcheck: path: /healthz interval: "2s" timeout: "1s" routers: traefik-router: rule: "Host(`traefik.xxx.xx`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))" service: api@internal entrypoints: - web - websecure special-router: rule: "Host(`special.xxx.xx`)" service: special-service entrypoints: - web - websecure tls: certresolver: letsencrypt certificatesresolvers: letsencrypt: acme: email: xxx@xxx.xx storage: /etc/letsencrypt/acme.json httpchallenge: entrypoint: web ``` Here are the logs from the container ```auto 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:103 > Traefik version 3.2.0 built on 2024-10-28T14:49:00Z version=3.2.0 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/cmd/traefik/traefik.go:110 > Static configuration loaded [json] staticConfiguration={"api":{"dashboard":true,"insecure":true},"certificatesResolvers":{"letsencrypt":{"acme":{"caServer":"https://acme-v02.api.letsencrypt.org/directory","certificatesDuration":2160,"email":"xxx@xxx.xx","httpChallenge":{"entryPoint":"web"},"keyType":"RSA4096","storage":"/etc/letsencrypt/acme.json"}}},"entryPoints":{"traefik":{"address":":8080","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"web":{"address":":80","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"websecure":{"address":":443","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}}},"global":{"checkNewVersion":true},"log":{"format":"common","level":"DEBUG"},"providers":{"providersThrottleDuration":"2s"},"serversTransport":{"maxIdleConnsPerHost":200},"tcpServersTransport":{"dialKeepAlive":"15s","dialTimeout":"30s"}} 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/cmd/traefik/traefik.go:626 > Stats collection is disabled. Help us improve Traefik by turning this feature on :) More details on: https://doc.traefik.io/traefik/contributing/data-collection/ 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:73 > Starting provider aggregator aggregator.ProviderAggregator 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:231 > Starting TCP Server entryPointName=websecure 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:231 > Starting TCP Server entryPointName=web 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/server/server_entrypoint_tcp.go:231 > Starting TCP Server entryPointName=traefik 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.ChallengeTLSALPN 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.ChallengeTLSALPN provider configuration config={} 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *traefik.Provider 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *traefik.Provider provider configuration config={} 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.Provider 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.Provider provider configuration config={"HTTPChallengeProvider":{},"ResolverName":"letsencrypt","TLSChallengeProvider":{},"caServer":"https://acme-v02.api.letsencrypt.org/directory","certificatesDuration":2160,"email":"xxx@xxx.xx","httpChallenge":{"entryPoint":"web"},"keyType":"RSA4096","storage":"/etc/letsencrypt/acme.json","store":{}} 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:221 > Attempt to renew certificates "720h0m0s" before expiry and check every "24h0m0s" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme 2024-11-08T14:26:47Z INF github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:859 > Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"middlewares":{"dashboard_redirect":{"redirectRegex":{"permanent":true,"regex":"^(http:\\/\\/(\\[[\\w:.]+\\]|[\\w\\._-]+)(:\\d+)?)\\/$","replacement":"${1}/dashboard/"}},"dashboard_stripprefix":{"stripPrefix":{"prefixes":["/dashboard/","/dashboard"]}}},"routers":{"acme-http":{"entryPoints":["web"],"priority":9223372036854775807,"rule":"PathPrefix(`/.well-known/acme-challenge/`)","ruleSyntax":"v3","service":"acme-http@internal"},"api":{"entryPoints":["traefik"],"priority":9223372036854775806,"rule":"PathPrefix(`/api`)","ruleSyntax":"v3","service":"api@internal"},"dashboard":{"entryPoints":["traefik"],"middlewares":["dashboard_redirect@internal","dashboard_stripprefix@internal"],"priority":9223372036854775805,"rule":"PathPrefix(`/`)","ruleSyntax":"v3","service":"dashboard@internal"}},"serversTransports":{"default":{"maxIdleConnsPerHost":200}},"services":{"acme-http":{},"api":{},"dashboard":{},"noop":{}}},"tcp":{"serversTransports":{"default":{"dialKeepAlive":"15s","dialTimeout":"30s"}}},"tls":{},"udp":{}} providerName=internal 2024-11-08T14:26:47Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{},"tcp":{},"tls":{},"udp":{}} providerName=letsencrypt.acme 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:321 > No default certificate, fallback to the internal generated certificate tlsStoreName=default 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/stripprefix/strip_prefix.go:32 > Creating middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal middlewareType=StripPrefix routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:17 > Creating middleware entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:18 > Setting up redirection from ^(http:\/\/(\[[\w:.]+\]|[\w\._-]+)(:\d+)?)\/$ to ${1}/dashboard/ entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_redirect@internal routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:321 > No default certificate, fallback to the internal generated certificate tlsStoreName=default 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/stripprefix/strip_prefix.go:32 > Creating middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal middlewareType=StripPrefix routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_stripprefix@internal routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:17 > Creating middleware entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/redirect/redirect_regex.go:18 > Setting up redirection from ^(http:\/\/(\[[\w:.]+\]|[\w\._-]+)(:\d+)?)\/$ to ${1}/dashboard/ entryPointName=traefik middlewareName=dashboard_redirect@internal middlewareType=RedirectRegex routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/observability/middleware.go:33 > Adding tracing to middleware entryPointName=traefik middlewareName=dashboard_redirect@internal routerName=dashboard@internal 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=traefik middlewareName=traefik-internal-recovery middlewareType=Recovery 2024-11-08T14:26:48Z DBG github.com/traefik/traefik/v3/pkg/middlewares/recovery/recovery.go:25 > Creating middleware entryPointName=web middlewareName=traefik-internal-recovery middlewareType=Recovery ``` `/etc/letsencrypt/acme.json` is empty. I've already checked - the domain name is pointing to the correct IP - I'm able to access the traefik dashboard in an insecure fashion What I expect to see is SSL certs be generated for my domain `special.xxx.xx`. But its not happening. The thing is I'm not able to locate any errors. So I'm not sure where to look. Can someone point me in the right direction! ---
**Author:** ![granxavi](https://avatars.discourse-cdn.com/v4/letter/g/b5a626/32.png) [@granxavi](https://community.traefik.io/u/granxavi)\ **Post date:** [November 13, 2024, 7:21pm UTC](https://community.traefik.io/t/traefik-in-docker-not-issuing-ssl-certificates/25082/2 "2024-11-13T19:21:36Z")
Hi, I am not using the letsencrypt folder I use the acme.json directly, but I am using cloudflare. Try this and see if this works. ` - /yourpath/acme.json:/acme.json` Also with go inside the container and check if your certs are in /etc/letsencrypt `docker exec -it sh` `cd /ect/letsencrypt` `ls` ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [November 13, 2024, 10:06pm UTC](https://community.traefik.io/t/traefik-in-docker-not-issuing-ssl-certificates/25082/3 "2024-11-13T22:06:55Z")
Dynamic config like http `routers` and `services` need to go into a separate dynamic config file, which needs to be loaded via `providers.file` in static config. I usually prefer to declare TLS globally on entrypoint, to not repeat on every router, see [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt).