Traefik and self-signed SSL

Question

Noob to Traefik and Docker. I have prepared a self signed certiicate using:

openssl req -x509 -newkey rsa:4096 -keyout www.example.co.uk.key -out www.example.co.uk.crt-days 365

In my traefik.toml file I have:

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]
    [[entryPoints.https.tls.certificates]]
    certFile = "certs/www.example.co.uk.crt"
    keyFile = "certs/www.example.co.uk.key"

However this results in:

traefik          | time="2019-06-17T22:11:17Z" level=debug msg="Serving default cert for request: \"www.example.co.uk\""
traefik          | time="2019-06-17T22:11:17Z" level=debug msg="http: TLS handshake error from 172.20.0.1:57770: tls: no certificates configured"

If I omit the cert definitions so that traefik.toml reads as:

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]
  #  [[entryPoints.https.tls.certificates]]
  #  certFile = "certs/www.example.co.uk.crt"
  #  keyFile = "certs/www.example.co.uk.key"

I get the dummy cert provided by Traefik and it works great but I just want to wrap my head around why my defined certs are not being used.

In my docker-compose.yml I believe I have mounted the correct volume:

volumes:
  - /var/run/docker.sock:/var/run/docker.sock # So that Traefik can listen to the Docker events
  - ./traefik.toml:/traefik.toml
  - /var/www/docker/certs:/certs

And the certs reside at certs/ relative to my docker-compose.yml and traefik.toml files. Permissions seem good as well both owned by root - the crt having 644 and key having 600.

How can I use a self-signed cert instead of Traefiks defaults?

Answer 1

Probably a path mismatch, particularly with some paths relative and others absolute. Try the following in your compose file (relative path to local certs):

volumes:
  - /var/run/docker.sock:/var/run/docker.sock
  - ./traefik.toml:/traefik.toml
  - ./certs:/certs

And then switch to an absolute path in the toml (leading slash on certs):

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]
    [[entryPoints.https.tls.certificates]]
    certFile = "/certs/www.example.co.uk.crt"
    keyFile = "/certs/www.example.co.uk.key"