Traefik used to work perfectly, but now always falls back to default cert

Traefik Traefik v3 (latest)
, ,
1

Hi!
My Traefik setup was working perfectly.
And then all of a sudden Traefik started serving not the certificates it requested via cloudflare/let's encrypt but the fallback Traefik one.
I setup Traefik completely new to try it from scratch, but I am getting the same results. Does anybody have an idea what I am doing wrong? And don't wonder why I put docker as a provider into the traefik.yml I am planning on letting it auto discover everything again once it serves the right certificate. The result is the same with the file and docker.

This is my docker compose:

services:
  traefik:
    image: traefik:v3.7
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    environment:
      - CF_DNS_API_TOKEN=${CF_DNS_API_TOKEN}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/etc/traefik/traefik.yml:ro
      - ./acme.json:/etc/traefik/acme.json
      - ./file.yml:/etc/traefik/dynamic/file.yml:ro
    networks:
      - my-bridge

networks:
  my-bridge:
    external: true

this is my traefik.yml:

api:
  dashboard: true
  insecure: true

providers:
  docker:
    exposedByDefault: false
    network: my-bridge
  file:
    directory: /etc/traefik/dynamic
    watch: true

entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

log:
  level: DEBUG

certificatesResolvers:
  cloudflare:
    acme:
      email: example@example.com #my own
      storage: /etc/traefik/acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

For simplicity I created a file.yml:

http:
  routers:
    portainer-https:
      rule: "Host(docker.example.com)"
      entryPoints:
        - websecure
      tls:
        certResolver: cloudflare
      service: portainer

services:
  portainer:
    loadBalancer:
      servers:
        - url: "http://portainer:9000"

When I start the container everything works, but when I run this I am getting TRAEFIK DEFAULT CERT:

openssl s_client -connect docker.example:443 -servername docker.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates
subject=CN = TRAEFIK DEFAULT CERT
issuer=CN = TRAEFIK DEFAULT CERT
notBefore=Jul  9 01:00:39 2026 GMT
notAfter=Jul  9 01:00:39 2027 GMT

This is what is currently running on my traefik:

{
   "routers":{
      "api@internal":{
         "entryPoints":[
            "traefik"
         ],
         "service":"api@internal",
         "rule":"PathPrefix(`/api`)",
         "ruleSyntax":"default",
         "priority":9223372036854775806,
         "observability":{
            "accessLogs":true,
            "metrics":true,
            "tracing":true,
            "traceVerbosity":"minimal"
         },
         "status":"enabled",
         "using":[
            "traefik"
         ]
      },
      "dashboard@internal":{
         "entryPoints":[
            "traefik"
         ],
         "middlewares":[
            "dashboard_redirect@internal",
            "dashboard_stripprefix@internal"
         ],
         "service":"dashboard@internal",
         "rule":"PathPrefix(`/`)",
         "ruleSyntax":"default",
         "priority":9223372036854775805,
         "observability":{
            "accessLogs":true,
            "metrics":true,
            "tracing":true,
            "traceVerbosity":"minimal"
         },
         "status":"enabled",
         "using":[
            "traefik"
         ]
      },
      "portainer-https@file":{
         "entryPoints":[
            "websecure"
         ],
         "service":"portainer",
         "rule":"Host(`docker.example.com`)",
         "priority":26,
         "tls":{
            "options":"default",
            "certResolver":"cloudflare"
         },
         "observability":{
            "accessLogs":true,
            "metrics":true,
            "tracing":true,
            "traceVerbosity":"minimal"
         },
         "status":"enabled",
         "using":[
            "websecure"
         ]
      }
   },
   "middlewares":{
      "dashboard_redirect@internal":{
         "redirectRegex":{
            "regex":"^(http:\\/\\/(\\[[\\w:.]+\\]|[\\w\\._-]+)(:\\d+)?)\\/$",
            "replacement":"${1}/dashboard/",
            "permanent":true
         },
         "status":"enabled",
         "usedBy":[
            "dashboard@internal"
         ]
      },
      "dashboard_stripprefix@internal":{
         "stripPrefix":{
            "prefixes":[
               "/dashboard/",
               "/dashboard"
            ]
         },
         "status":"enabled",
         "usedBy":[
            "dashboard@internal"
         ]
      }
   },
   "services":{
      "api@internal":{
         "status":"enabled",
         "usedBy":[
            "api@internal"
         ]
      },
      "dashboard@internal":{
         "status":"enabled",
         "usedBy":[
            "dashboard@internal"
         ]
      },
      "noop@internal":{
         "status":"enabled"
      },
      "portainer@file":{
         "loadBalancer":{
            "servers":[
               {
                  "url":"http://portainer:9000"
               }
            ],
            "strategy":"wrr",
            "passHostHeader":true,
            "responseForwarding":{
               "flushInterval":"100ms"
            }
         },
         "status":"enabled",
         "usedBy":[
            "portainer-https@file"
         ],
         "serverStatus":{
            "http://portainer:9000":"UP"
         }
      }
   }
}

I can provide the sanitized debug logs, but I currently don't know how to put them in here because of the char limit.

2

Well, what changed? Did you upgrade Traefik? Are the config files mounted from a shared drive that was temporarily disconnected? What does acme.json contain? What does Traefik debug log tell you about tls, certresolver or err?

Have you tried assigning the certResolver globally to entrypoint only (example)?

3

Hey! Thanks for your reply. That's the thing, I didn't change anything. Both the configs and the acme.json is not on another drive. I think I haven't tried assigning the certResolver globally to entrypoint only. The acme (even if emptied before the start of traefik) is getting the certificates from cloudflare. Everything is working, but when I am going to the website it is using the fallback certificate. But in response I went a bit overboard because I was frustrated. I migrated my containers from docker compose to a minimalist k8s (k3s). I am using k8s at work so I am familiar with that and since then everything is working again. If you are interested here are my logs though from my previous setup.

Here are my logs: Link to Sharetext with Logs
I didn't know how to get the logs into this discussion otherwise, because of the char limit.

4

I checked for err and it stated something about recursive DNS. Did you run something like Pi-Hole? I assume you replaced the real domain names in the log?