Traefik ACME certificate expired

Traefik ACME expiry usually means acme storage lost, challenge ports blocked, or replicas fought over acme.json.

When this happens

Routers up but browsers warn on Traefik entrypoint hostname. GitOps applied router CRDs referencing a resolver name absent from the static Traefik provider configuration. GitOps commits can restore an old static config fragment that references an abandoned ACME resolver name while routers still point at it.

Ephemeral pods wiped acme.json without persistent volume. Nomad or swarm schedules may place Traefik without persistent volume mounts. Version skew between Traefik chart and CRD versions leaves resolver CR fields ignored while routers still reference names.

First response

Traefik ACME storage or challenge misconfig left edge certificates expired—fix entryPoints and persistent acme.json.

Searches for traefik acme certificate expired usually mean automated renewal failed, succeeded locally but never reached the TLS listener, or hit Let's Encrypt rate limits. The fix is almost always permissions, challenge reachability, or a missing reload—not buying a longer-lived commercial cert as the first move.

For Traefik ACME certificate expired, read the ACME or panel error verbatim, run a dry-run renewal if your stack supports it, then confirm what certificate strangers receive on port 443 after you deploy. Certificate files on disk lie; only live handshakes matter for users.

Traefik stores ACME certs in a json or yaml acme storage file; corruption or read-only volume yields expired presents even while routers look healthy. Check Traefik logs for unable to obtain ACME certificate and verify file locks on multi-replica setups. Triage should capture timestamps, account URLs, and the last Boulder error type before infrastructure changes widen blast radius. Pause destructive retries until you can cite the last Boulder error type and the challenge mechanism in use; random package reinstalls rarely fix presentation gaps.

See also ACME DNS-01 challenge propagation delays and ACME HTTP-01 challenge failed 403.

Why renewal failed

Each router tls.domains entry drives independent renewal. Lock acme.json backups with the same encryption standard as private keys—loss equals account key compromise risk for every name on that resolver. Edge proxy ACME storage is stateful infrastructure requiring backup like any database.

HTTP-01 needs published entryPoint web; TLS challenge needs tls on 443. TCP routers with TLS need distinct cert resolver entries; HTTP router renewals do not automatically cover TLS passthrough routes. Multi-replica Traefik needs explicit strategy for shared ACME state.

Behind external LB, challenges must reach Traefik not only upstream apps. Document whether Helm or static file provider owns ACME config to prevent dual writers. Escalate with timestamps, hostnames, and serial comparisons attached so the next engineer does not repeat already-failed renew attempts.

HTTP-01 and TLS-ALPN challenges need correct entryPoints and published ports. DNS challenge needs provider credentials in static config. Each router tls.domains entry drives renewal. Clarify in tickets whether failure is validation, issuance, deploy, or listener presentment—teams too often mix these phases when reading logs. Edge proxy TLS is product TLS for microservices architectures even when apps are healthy—monitor Traefik separately from deployment green counts.

Not fixed by only restarting apps behind Traefik if edge cert expired. Losing acme.json on pod restart presents as mysterious edge expiry even though application containers remain healthy behind Traefik.

Common causes

These patterns drive most traefik acme certificate expired tickets. They explain why automation logs look green while browsers or APIs still break.

acme.json on ephemeral container disk lost. Read-only container rootfs after security scans can revert acme.json permissions nightly until Traefik cannot append renewals. Mis-set propagation timeout for DNS resolvers that is too aggressive fails DNS-01 at the edge even when authoritative servers are correct.

Two replicas wrote same acme.json.

Cloud LB terminated TLS so HTTP-01 never reached Traefik. Consul/etcd provider lag leaves Traefik reading stale router TLS config referencing removed resolver.

Diagnose

Enable brief debug on ACME resolver and read Traefik logs. Confirm whether expired material is on the public entrypoint router or an internal admin router—mixing them in tickets sends engineers to the wrong config file.

docker logs traefik 2>&1 | tail -n 80
# or kubectl logs deploy/traefik -n ingress

Enable DEBUG on ACME client section briefly; confirm which entryPoint received connection. Hit Traefik internal ping on each entryPoint port to confirm listener still bound after obtain errors. Confirm whether routers use tls.certresolver consistently; mixed manual tls secrets and ACME routers on one entrypoint cause split brain.

Fix step-by-step

Follow this sequence for traefik acme certificate expired. Capture command output after each step so the next responder can pick up without rerunning destructive changes.

1. Mount persistent volume for acme storage in prod.
2. Ensure single writer or use provider that supports multi-replica ACME.
3. Open ports for configured challenge on entryPoints.
4. Fix DNS provider env vars for DNS challenge mode.
5. Rolling restart after successful obtain.
6. Dashboard certificates tab matches openssl.
7. Backup encrypted acme.json.
8. Alert on resolver error rate.
9. Archive redacted ACME logs and openssl transcripts in the ticket before closing.
10. Schedule a follow-up dry-run before the next natural renewal window.
11. Verify Traefik dashboard cert expiry matches public openssl for each entrypoint.

Verify the live certificate

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname on the certificate. Run the same command after any reload or deploy change; acceptance means notAfter moved forward and serial changed versus the incident-opening capture.

How to read the output

openssl entrypoint DNS name; compare Traefik dashboard cert tab. Traefik dashboard certificate lists can lag config reloads; openssl against public entrypoints remains the acceptance test after ACME obtains claim success.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Replace HOST with the public hostname users request.

Roll out and verify

Fix challenge path; ensure persistent volume for acme storage.

Rolling restart Traefik after renewal success. Plan maintenance to delete and recreate resolver only with backed-up account key and rate limit awareness.

Backup acme.json with encryption; alert on resolver errors. Publish a short post-incident note listing which hop served stale TLS and which command proved the fix so the next renewal inherits a checklist.

What to automate

Scrape Traefik ACME error metrics or log lines for unable to obtain. Monitor Traefik ACME resolver error counters and acme.json age.

ssldays watches customer hostnames Traefik fronts. ssldays checks routers customers hit on public entrypoints. ssldays monitors public entrypoints that Traefik terminates, not only in-cluster health probes.