# Traefik not serving custom SSL certificate

**URL:** <https://community.traefik.io/t/traefik-not-serving-custom-ssl-certificate/19865>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [September 17, 2023, 7:48pm UTC](https://community.traefik.io/t/traefik-not-serving-custom-ssl-certificate/19865 "2023-09-17T19:48:46Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 18, 2023, 10:28am UTC](https://community.traefik.io/t/traefik-not-serving-custom-ssl-certificate/19865/6 "2023-09-18T10:28:28Z")

</div>

How Traefik TLS works. Traefik will first look for a matching cert (by hostname encoded in the cert, works with wildcards) in your list of defined certs:

```auto
tls:
  certificates:
    - certFile: /path/to/domain.cert
      keyFile: /path/to/domain.key
    - certFile: /path/to/second-domain.cert
      keyFile: /path/to/second-domain.key

```

If no match is found, then Traefik will use the single cert in the default store:

```auto
tls:
  stores:
    default:
      defaultCertificate:
        certFile: path/to/cert.crt
        keyFile: path/to/cert.key

```

If nothing is defined, it will create a custom Traefik cert, which the browser will warn about.

Make sure your cert files have the correct content:

```auto
certFile:
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
keyFile:
        -----BEGIN PRIVATE KEY-----
        ...
        -----END PRIVATE KEY-----

```

---

_[View the full topic](https://community.traefik.io/t/traefik-not-serving-custom-ssl-certificate/19865)._