Knowledge Base

1     sudo cp server.crt /opt/traefik/certs/ 

2     sudo cp server.key /opt/traefik/certs/ 

Apply secure file permissions: 

1     sudo chmod 644 /opt/traefik/certs/server.crt 

2     sudo chmod 600 /opt/traefik/certs/server.key 

Step 2: Verify the Certificate Matches the Private Key 

Confirm that the certificate and private key belong to the same key pair. 

Public key from the certificate: 

1     openssl x509 -in /opt/traefik/certs/server.crt -noout -pubkey | openssl sha256 

Public key from the private key: 

1     sudo openssl pkey -in /opt/traefik/certs/server.key -pubout | openssl sha256 

✅ The hash values must be identical. 

Step 3: Configure the TLS Certificate in Traefik 

Create or update the TLS configuration file used by Traefik. 

File: /opt/traefik/dynamic/tls.yml 

1     tls: 

2       certificates: 

3         - certFile: /certs/server.crt 

4           keyFile: /certs/server.key 

This configuration tells Traefik which certificate and private key to load. 

Step 4: Bind the Certificate to a Hostname (SNI) 

Create or update an HTTPS router that enables TLS and specifies the hostname. 

File: /opt/traefik/dynamic/router.yml 

1     http: 

2       routers: 

3         https-router: 

4           entryPoints: 

5             - websecure 

6           rule: "Host(`example.domain.com`)" 

7           service: noop@internal 

8           tls: {} 

Traefik selects the certificate based on the hostname provided by the client during the TLS handshake (SNI). 

Step 5: Reload Traefik 

Restart Traefik to apply the new certificate configuration: 

1     sudo docker restart traefik 

Step 6: Validate the Certificate Binding 

From a client system, verify that the correct certificate is presented: 

1     openssl s_client -connect example.domain.com:443 -servername example.domain.com