Setting Traefik: Obtaining Single Wildcard Let's Encrypt Certificate
Welcome to our guide on setting up Traefik, a modern HTTP reverse proxy and load balancer, while transitioning from Nginx proxy manager. In this article, we will walk you through the process of obtaining a single wildcard Let's Encrypt certificate for your Traefik setup. We'll provide a detailed explanation of the key concepts and cover the following subtopics:
Prerequisites
Enabling the ACME Resolver in Traefik
Wildcard Certificate Configuration
Validation and Certificate Issuance
Prerequisites
Before diving into the certificate acquisition process, ensure that your environment meets the following prerequisites:
Traefikinstalled and running- A domain name with DNS management
- Access to your domain name's DNS provider API for automated DNS challenge validation
Enabling the ACME Resolver in Traefik
The Automatic Certificate Management Environment (ACME) protocol is used for obtaining, renewing, and revoking SSL certificates. Traefik supports the ACME protocol through its built-in ACME resolver. To enable the ACME resolver, you'll need to configure it in your /etc/traefik/traefik.yaml file:
api:
dashboard: true
global:
checkNewVersion: true
sendAnonymousUsage: true
providers:
docker:
endpoint: "unix:///var/run/docker.sock"
watch: true
swarmMode: false
entryPoints:
web:
address: ":80"
acme:
email: "[email protected]"
storage: "acme.json"
keyType: "EC256"
onHostRule: true
tlsChallenge:
provider: dns-01
delayBeforeCheck: 0
Make sure you replace "[email protected]" with your actual email address. This email will be used for correspondence regarding your certificates from Let's Encrypt. Also, ensure that the "acme.json" file is writable by the Traefik user.
Wildcard Certificate Configuration
Let's Encrypt introduced wildcard certificates as of February 2018, allowing a single certificate to be issued for multiple subdomains. To request a wildcard certificate, you need to modify your DNS configuration accordingly.
In your /etc/traefik/traefik.yaml, add the following provider block:
acme:
...
# Add this block for the DNS-01 provider configuration (replace with your DNS provider)
dnsChallenge:
provider: cloudflare # Replace with your DNS provider
config:
# Replace with your specific DNS provider configuration
cloudflareAPI:
email: "[email protected]"
apiKey: "your.cloudflare.api.key"
# Add a new list with hosts you would like to get a wildcard certificate for
domains:
- main: "*.example.com"
sans: []
Validation and Certificate Issuance
Now that you have enabled the ACME resolver and configured the DNS challenge, Traefik will manage SSL certificate validation and issuance automatically. As new hosts are added, Traefik will issue SSL certificates using the Let's Encrypt certificate authority through the configured DNS challenge. To verify the SSL certificate, navigate to https://yourdomain.com.
- Configure the ACME resolver, enabling DNS challenge in your
/etc/traefik/traefik.yaml - Set up the DNS challenge and provide your specific DNS provider configuration
- Add a list of domains you would like to manage, including a wildcard domain