Unable to append certificate XXX to store: unable to generate TLS certificate : tls: private key does not match public key

Traefik Traefik v2 (latest)
1

I'm attempting to replace our wildcard cert stored in a Kubernetes Secret referenced by an IngressRoute and get this error:

Unable to append certificate XXX to store: unable to generate TLS certificate : tls: private key does not match public key

The first certificate in the tls.crt is our wildcard, following by the intermediate cert and then the root cert. I've also tried just our wildcard and intermediate, and then just our wildcard and I get the same error.

I've already installed the cert and key onto numerous other websites so I know there isn't a problem with the cert/key pair. I also get matching output when I verify using openssl and the following commands:

openssl x509 -noout -modulus -in wildcard.crt | openssl md5
openssl rsa -noout -modulus -in wildcard.key | openssl md5

We are currently running Traefik v2.0.7 (Working on upgrading... have had other priorities)

2

Something odd I just noticed, where the title has XXX, it looks like the first 50 characters of a certificate. But it doesn't match either my new cert or old cert. I've verified the contents of the secret match my cert/key pair as well.

3

So it looks like there was an error in the traefik default cert. Somehow I updated it's private key but not the cert, which apparently was what was giving the error. No idea how I would have known without randomly looking