Use Traefik with self-signed certificate

I didn't see it at first but there's a typo in you tls.yml file:

certificates:
    - certFile: /home/appuser/data/certificates/cer.crt
      keyFile: /home/appuser/data/certificates/key.key
      stores:
        - default

- default instead of -default. I tied it and it solves the No default certificate, generating one.

Then, regarding the 404 you get when you curl https://localhost --insecure, it perfectly fine with your configuration. Your frontendssl is not specified in "traefik.http.routers.traefik.entrypoints=frontend" and therefore nothing is exposed on port 443.