For Traefik to serve a site over HTTPS without intervention, four pieces must be connected: a certificate resolver that speaks ACME, a protected storage file, an HTTP-to-HTTPS redirect, and a TLS option that rejects obsolete protocols. This lesson is for people publishing a service behind Traefik who want it to renew certificates automatically. It does not explain the protocol again; it teaches the Traefik configuration, then asks you to prove it in a test environment.
The protocol itself, ACME (how an authority validates a name and issues a certificate), has its own lesson: Automatic certificates: ACME and challenges. It also issues an initial certificate against Pebble. The challenge types, staging and certificate lifetimes are covered there; here, you only need a general understanding of them.
What you will learn
These objectives cover Traefik configuration, secret protection and the evidence to observe from a client.
- Place a certificate resolver in Traefik configuration and attach it to a service
- Understand what ACME storage contains and why access must be limited to its owner
- Redirect HTTP to HTTPS permanently
- Define a TLS option that rejects obsolete protocol versions
- Explain why you need to observe the certificate served, rather than checking storage alone
Prerequisites
You need to distinguish Traefik's static and dynamic settings and know the basics of the ACME protocol before following this lesson.
- Read Traefik: entrypoints, routers and services to distinguish static and dynamic configuration.
- Know how to publish a service with Traefik, for example with Traefik with Docker.
- Know the general idea behind ACME from Automatic certificates: ACME and challenges.
- Know how to interpret TLS certificate details. See TLS diagnostics.
- For the lab, have the provided machine with Docker, Compose and
sudoaccess.
Where does each setting belong in Traefik?
This lesson's settings are split between static and dynamic configuration. Using the wrong file is a common cause of failure. Traefik reads static configuration only at startup; it reloads dynamic configuration while running. See the lesson on entrypoints, routers and services.
| Element | Role | Where it is declared |
|---|---|---|
| Certificate resolver | Contacts the ACME authority, obtains and renews certificates | Static |
| ACME storage | Keeps the account and certificates across restarts | Static, through the resolver |
| HTTP-to-HTTPS redirect | Sends the client to the secure version | Static, on the HTTP entrypoint |
| TLS option | Sets the minimum version and cipher suites | Dynamic |
| Resolver selected by a service | Specifies which resolver handles a name | Dynamic, on the router |
A change to the resolver or redirect therefore requires a Traefik restart, while a TLS option takes effect without a restart. The lab lets you observe this.
How does the certificate resolver work?
A certificate resolver is a block of static configuration that describes how Traefik obtains certificates: which authority to contact, which account to use, which challenge to perform and where to store the result. A router that declares the resolver and a host name triggers issuance. Traefik requests the certificate, stores it and renews it before expiration without requiring action from you.
It contains four pieces of information:
- The authority's directory URL, which selects the authority: a public authority in production or a test authority while learning
- The account's contact address
- The challenge used to prove control of the name
- The storage path
When the test authority is not public, Traefik must also trust its root to connect to the directory. Otherwise, the connection to the authority fails before issuance begins. This trust applies to the connection between Traefik and the authority, not to the certificate seen by the client.
The challenge must be reachable from outside: the name must point to the machine, and the port contacted by the authority must reach Traefik. The lab provides a machine where this is already true.
DNS challenges, which are useful for wildcard certificates, depend on a DNS provider and its credentials. This lesson does not cover them because testing them requires a third-party account; the ACME lesson explains the concept.
Why protect ACME storage?
The storage file contains the ACME account's private key and the private keys of issued certificates. Anyone who reads it can impersonate your service. These keys are stored there when not in use.
The file contains private keys and must only be accessible to accounts that need them. Protect backups too, and make sure the location is persistent: losing it can trigger new requests to the authority and complicate renewal.
The exercise provides a test environment for observing Traefik. Do not infer the production permissions policy from a temporary file.
How do you redirect HTTP to HTTPS?
The redirect is declared on the HTTP entrypoint. Traefik responds there before routing and sends the client to the HTTPS entrypoint. Placing it at this level applies it to every service without repeating it on each router. Choose a temporary or permanent response based on how long the change will last: clients and caches can remember a permanent move.
A common pitfall is that the ACME challenge also arrives over HTTP. Traefik handles the challenge path before the redirect, so enabling the redirect does not break issuance. If issuance fails after adding a redirect, look elsewhere, such as the name, port or authority log.
The Middlewares lesson shows another way to redirect, using a middleware on a router. Use an entrypoint when the rule should apply to all traffic.
How do you limit the accepted TLS versions?
A TLS option sets the minimum accepted version. A client that can only speak a rejected protocol cannot establish a connection. Do not enable old versions unless there is a documented compatibility need. Choose the policy based on expected clients and organizational requirements.
The option belongs in dynamic configuration and can be attached to a router or applied by default. Keep these pitfalls in mind:
- An option named
defaultis the default for routers that do not declare one. Another option must be selected explicitly. - A rejection occurs during the TLS handshake, before any HTTP response.
- Headers such as HSTS belong to middlewares and do not replace a TLS option.
How can you prove that a certificate was really renewed?
A certificate in storage does not by itself prove that Traefik is serving it or will renew it correctly. A reliable check observes the certificate served to the client and compares it with the expected authority. Also account for the current state of a test authority: its trust material may change when the environment is recreated. For public certificates, schedules and limits depend on the authority; do not transfer temporary exercise settings to production.
Practice: configure HTTPS and ACME in Traefik
The lab has you assemble a Traefik configuration with a test authority and a prepared service. Choose the relevant settings and check their effects from the service. The lab scenario describes the context and assessment criteria; this lesson explains the concepts and responsibilities of each setting without providing a configuration to copy.
What should you do when a certificate does not arrive or renew?
Traefik's log and the authority's log almost always show which side of the exchange failed. Check them in this order:
- Read the Traefik log. It reports errors such as an authority trust failure, overly permissive storage or a rejected challenge.
- Read the authority's log. If it shows no request, the problem is on the Traefik side (the resolver is not attached to the router, or the directory is unreachable). If it shows a rejection, inspect the challenge.
- Check that the router name, the name requested by the client and the certificate name match.
- If the served certificate is old, check its remaining lifetime. Renewal starts before expiration, not at the moment it expires.
- If the client rejects a valid certificate, compare its root with the active authority session.
If Traefik's log mentions no resolver, the router does not declare one, or static configuration has not been reloaded by a restart.
Key points
These points connect each setting to its role and make HTTPS publication easier to verify.
- The certificate resolver is declared in static configuration; a router selects it in dynamic configuration.
- ACME storage contains private keys. Restrict access to its owner and keep the storage persistent.
- Put an HTTP-to-HTTPS redirect on the entrypoint when the rule applies to every router.
- A TLS option sets the minimum version; a client observes its effect when a handshake is rejected.
- To prove renewal, compare the authority's state with the certificate actually served to a client.
- A test authority's root changes at every restart; verify against the active session's root.
Knowledge check
The quiz covers the role of the settings and how to verify their effects.
Knowledge check
Check what you have learned with this interactive quiz
How it works
- The timer starts when you click Start
- Multiple choice, true/false and short answer questions
- You can move between questions
- Detailed results are shown at the end
Starts the quiz and the timer
Review
(0/0)Score by domain
A domain groups several guides and gets several questions, so its score is more reliable than a per-topic score, which often rests on a single question.
Summary
Strengths
No topic passed at 80% on at least two questions yet.
Weak areas
No topic below the pass mark.
Recommended next
Hints before you try again?
Continue the course: Traefik middlewares: rewrite, redirect and chain
A new full quiz with random questions
Work again only on the questions you missed