# Traefik issues self signed certificates

**URL:** <https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038>\
**Category:** Traefik v2\
**Tags:** file, docker\
**Created:** [June 23, 2023, 3:55am UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038 "2023-06-23T03:55:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![deyanira87](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/deyanira87/32/7283_2.png) [@deyanira87](https://community.traefik.io/u/deyanira87)\
**Post date:** [June 23, 2023, 3:55am UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/1 "2023-06-23T03:55:47Z")

</div>

Hi everyone.

I'm using docker with traefik 2.10 and dynamics files (yaml).  
I'm facing a problem with container's domain certificate. I cannot use lets encrypt or other provider.  
when I use my certificate which is configured with 2 files a **.cert** and a **.key** the web doesn´t work showing the error "_404 page not found_" in the web browser and in the traefik log I always get this errors:

```auto
level=error msg="accept tcp [::]:80: use of closed network connection" entryPointName=web
level=error msg="close tcp [::]:443: use of closed network connection" entryPointName=websecure

```

**But If I use lets encrypt the problem is solved** and I can surf the website without problems.

This is my **traefik.yml** configuration:

```auto
entryPoints:
  web:
    address: ":80"
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
  websecure:
    address: ":443"
    # http:
    # tls:
    # certResolver: lets-encrypt

providers:
  docker:
    endpoint: unix:///var/run/docker.sock
    exposedByDefault: false
    watch: true
    swarmMode: false
    
  file:
    directory: /etc/traefik/configuration
    watch: true

```

This is a fragment of my docker-compose file with the traefik config:

```auto
traefik:
    image: traefik:latest
    container_name: traefik
    restart: always
    networks:
      redesproxy:
        ipv4_address: 172.20.1.3
    ports:
      - "80:80"
      - "443:443"
    security_opt:
      - no-new-privileges:true
    volumes:
      - traefik_data:/etc/traefik
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/traefik.yml:/etc/traefik/traefik.yml
      - ./data/configuration:/etc/traefik/configuration **# Folder with dynamic configuration yml including certs files**

```

My web.yml dynamic file:

```auto
http:
  routers:
    www-web-develop:
      service: www-develop-service
      entryPoints:
        - websecure
      rule: "Host(`www.mydomain.com`)"
      middlewares:
        - gzip
  
  services:
    www-develop-service:
      loadBalancer: 
        servers:
          - url: "http://172.20.1.4:9007"

```

And finally in other yml file I have the certs config: (tls.yml)

```auto
tls:
  certificates:
    - certFile: /etc/traefik/configuration/certs/www.mydomain.com.crt
      keyFile: /etc/traefik/configuration/certs/www.mydomain.com.key

```

I check both files with OpenSSL and they have the same output.

What I missing in the certificates configuration? Or maybe I'm doing something wrong.

So... what do I need to do to get this domain with https work?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 23, 2023, 5:52am UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/2 "2023-06-23T05:52:16Z")

</div>

You need to enable TLS on entrypoint or router.

```auto
entryPoints:
  websecure:
    address: ':443'
    http:
      tls: {}

```

```auto
http:
  routers:
    my-https-router:
      tls: {}

```

([Doc](https://doc.traefik.io/traefik/routing/entrypoints/#tls), [Doc](https://doc.traefik.io/traefik/routing/routers/#tls))

---

<div class="post-metadata">

**Author:** ![deyanira87](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/deyanira87/32/7283_2.png) [@deyanira87](https://community.traefik.io/u/deyanira87)\
**Post date:** [June 23, 2023, 2:20pm UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/3 "2023-06-23T14:20:08Z")

</div>

Thanks for your answer.

I was reading the documentation but I don´t undertand how can I activate the http challenge with self signed certificates.

In this case, I haven't a certificatesResolvers configuration for the tls certificates. I handle in a standalone file (that was what I understood in the documentation)

What configuration I need to put in your code recomendation?

```auto
entryPoints:
  websecure:
    address: ':443'
    http:
      tls: {} **<-- here**

```

and

```auto
http:
  routers:
    my-https-router:
      tls: {} **<-- here**

```

if i'm using a tls.yml with only this code?

```auto
tls:
  certificates:
    - certFile: /etc/traefik/configuration/certs/www.mydomain.com.crt
      keyFile: /etc/traefik/configuration/certs/www.mydomain.com.key

```

If I use let's encrypt my code looks like this:

```auto
(...)
websecure:
    address: ":443"
    http:
      tls:
        certResolver: lets-encrypt

```

Best regards.

> Blockquote

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 23, 2023, 3:28pm UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/4 "2023-06-23T15:28:00Z")

</div>

If you want to use both, I recommend you enable custom TLS (`tls: {}`) or certresolver (`tls: certResolver: myresolver`) directly on the router.

---

<div class="post-metadata">

**Author:** ![deyanira87](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/deyanira87/32/7283_2.png) [@deyanira87](https://community.traefik.io/u/deyanira87)\
**Post date:** [June 23, 2023, 5:55pm UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/5 "2023-06-23T17:55:49Z")

</div>

Then if my self signed certificates are inside a tag " **certificates**" like in my yaml I can use something like this? Or isn't correct the code below?

```auto
websecure:
    address: ":443"
    http:
      tls:
        certResolver: **certificates** <-- my self signed tls tag

```

Regards and thank for your help

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [June 23, 2023, 7:38pm UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/6 "2023-06-23T19:38:01Z")

</div>

Load your custom TLS certs in a dynamic config file, load the config file in static config with `provider.file` and enable TLS on router with `tls: {}`.

Certresolver is only used for LetsEncrypt.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [June 26, 2023, 7:38pm UTC](https://community.traefik.io/t/traefik-issues-self-signed-certificates/19038/7 "2023-06-26T19:38:20Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.