Dear Developers, Community, Thank you for the marvel! I am trying to configure a Docker Compose container for a subdomain and HTTPS route. For some unknown reason, Traefik successfully gets and stores a cert for the main domain but for a subdomain that is for the container: pic.example.com. As …

From the doc : Any store definition other than the default one (named default) will be ignored, and there is therefore only one globally available TLS store. So pic.example.com is correctly created, as it is mentioned in Host(). But example.com is nowhere (where it isn't ignored), so it's not cre…

Thank you for the response! I've updated the main question message with additional details.

Traefik only supports a default tls store as far as I know. Not sure if that is the reason for your TLS issues. I wonder what you are doing with priority, it usually just works, maybe set a small number on catchall router. Why rewriteHeaders without any config? Even with httpChallenge you don't n…

You got so much config... I am sorry, but it is just a few, and I've already checked and compared the configuration with the example numerous times, and compared the setup with numerous setups of others. Not to mention that the example I read the first day I ever attempted to dive into Traefik do…

I can just provide some ideas, didn’t see any obvious errors. I would try to run it without the tls.yml file. It’s not needed for LE TLS to work.

In our case, the file tls.yaml is required, and defines the default certificate with a trusted CA that is used for connections without the Let's Encrypt cert available (e.g. not example.com but something.else in SNI yet in a connection to the same Traefik instance/IP address.

I get that, but does your sub-domain work without?

Thank you for responding! I haven't yet added more logs to the binary since I've been trying to build it inside containers only, and since their build scripts assume those are run on the host, I currently stopped with paths mismatch between the containers during building, and will return if required…

The previous log part 1/2 (due to the forum limit of 32,000 characters per message). The next log part 2/2: ... 2025-07-22T06:45:53Z DBG github.com/traefik/traefik/v3/pkg/server/router/tcp/manager.go:237 > Adding route for pic.example.com with TLS options default entryPointName=http 2025-07-22T06…

The TLSStore location... I see now... and am sorry for missing this note, apparently, and I appreciate you for pointing me out very much, @bluepuma77 ! Solution The working changed minimal configuration is the following: Traefik container file (excerpt): /traefik.yaml: # ... entryPoints: http: …

Why would Traefik serve the default self-generated certificate only for a subdomain of a Docker Compose container?

Traefik Traefik v3 (latest)

bluepuma77 July 20, 2025, 3:24pm 2

Share your full Traefik static and dynamic config, and Docker compose file.

Topic		Replies	Views
No default certificate, fallback... someone help please? Traefik v3 (latest) docker , letsencrypt-acme	12	421	October 23, 2025
Traefik wont route subdomain except .localhost, can access dashboard and docker applications through domain:port Traefik v2 docker , letsencrypt-acme	5	3523	May 1, 2023
Traefik serving default certificate instead letsencrypt Traefik v2 docker , letsencrypt-acme	5	12383	April 30, 2023
Default TLS configuration for a Lets Encrypt wildcard certificate Traefik v2 file , letsencrypt-acme	1	1081	October 20, 2023
Trouble understanding how traefik picks up a custom SSL certificate for a domain Traefik v2 docker , docker-swarm	14	21587	December 11, 2020

Why would Traefik serve the default self-generated certificate only for a subdomain of a Docker Compose container?

Related topics