Hi,
I have Traefik installed using the following configuration values.
logs:
general:
level: DEBUG
providers:
kubernetesGateway:
enabled: true
ports:
web:
expose:
default: true
websecure:
tls:
enabled: true
certResolver: letsencrypt
domains:
- main: davidshen84.duckdns.org
sans: []
service:
annotations:
metallb.io/address-pool: k3s-public
persistance:
enabled: true
certificatesResolvers:
letsencrypt:
acme:
caServer: https://acme-staging-v02.api.letsencrypt.org/directory
email: ---
storage: /data/acme.json
httpChallenge:
entryPoint: web
ingressRoute:
dashboard:
enabled: true
After installing the Traefik helm chart, I got the following logs in the traefik pod:
2025-08-03T02:17:49Z DBG github.com/traefik/traefik/v3/cmd/traefik/traefik.go:113 > Static configuration loaded [json[] staticConfiguration={"api":{"basePath":"/","dashboard":true},"certificatesResolvers":{"letsencrypt":{"acme":{"caServer":"https://acme-staging-v02.api.letsencrypt.org/directory","certificatesDuration":2160,"email":"davidshen84@proto.me","httpChallenge":{"entryPoint":"web"},"keyType":"RSA4096","storage":"/data/acme.json"}}},"entryPoints":{"metrics":{"address":":9100/tcp","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"traefik":{"address":":8080/tcp","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"web":{"address":":8000/tcp","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}},"websecure":{"address":":8443/tcp","forwardedHeaders":{},"http":{"maxHeaderBytes":1048576,"sanitizePath":true,"tls":{"certResolver":"letsencrypt","domains":[{"main":"davidshen84.duckdns.org"}]}},"http2":{"maxConcurrentStreams":250},"transport":{"lifeCycle":{"graceTimeOut":"10s"},"respondingTimeouts":{"idleTimeout":"3m0s","readTimeout":"1m0s"}},"udp":{"timeout":"3s"}}},"global":{"checkNewVersion":true,"sendAnonymousUsage":true},"log":{"format":"common","level":"DEBUG"},"metrics":{"prometheus":{"addEntryPointsLabels":true,"addServicesLabels":true,"buckets":[0.1,0.3,1.2,5],"entryPoint":"metrics"}},"ping":{"entryPoint":"traefik","terminatingStatusCode":503},"providers":{"kubernetesCRD":{"allowEmptyServices":true},"kubernetesGateway":{"statusAddress":{"service":{"name":"traefik","namespace":"kube-system"}}},"kubernetesIngress":{"allowEmptyServices":true,"ingressEndpoint":{"publishedService":"kube-system/traefik"}},"providersThrottleDuration":"2s"},"serversTransport":{"maxIdleConnsPerHost":200},"tcpServersTransport":{"dialKeepAlive":"15s","dialTimeout":"30s"}}
2025-08-03T02:17:49Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.ChallengeTLSALPN
2025-08-03T02:17:49Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.ChallengeTLSALPN provider configuration config={}
2025-08-03T02:17:49Z INF github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:202 > Starting provider *acme.Provider
2025-08-03T02:17:49Z DBG github.com/traefik/traefik/v3/pkg/provider/aggregator/aggregator.go:203 > *acme.Provider provider configuration config={"HTTPChallengeProvider":{},"ResolverName":"letsencrypt","TLSChallengeProvider":{},"caServer":"https://acme-staging-v02.api.letsencrypt.org/directory","certificatesDuration":2160,"email":"davidshen84@proto.me","httpChallenge":{"entryPoint":"web"},"keyType":"RSA4096","storage":"/data/acme.json","store":{}}
2025-08-03T02:17:49Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:232 > Attempt to renew certificates "720h0m0s" before expiry and check every "24h0m0s" acmeCA=https://acme-staging-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme
2025-08-03T02:17:49Z INF github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:884 > Testing certificate renew... acmeCA=https://acme-staging-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme
2025-08-03T02:17:49Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{"models":{"websecure":{"observability":{},"tls":{"certResolver":"letsencrypt","domains":[{"main":"davidshen84.duckdns.org"}]}}},"routers":{"acme-http":{"entryPoints":["web"[],"priority":9223372036854775807,"rule":"PathPrefix(`/.well-known/acme-challenge/`)","ruleSyntax":"v3","service":"acme-http@internal"},"ping":{"entryPoints":["traefik"[],"priority":9223372036854775807,"rule":"PathPrefix(`/ping`)","ruleSyntax":"v3","service":"ping@internal"},"prometheus":{"entryPoints":["metrics"],"priority":9223372036854775807,"rule":"PathPrefix(`/metrics`)","ruleSyntax":"v3","service":"prometheus@internal"}},"serversTransports":{"default":{"maxIdleConnsPerHost":200}},"services":{"acme-http":{},"api":{},"dashboard":{},"noop":{},"ping":{},"prometheus":{}}},"tcp":{"serversTransports":{"default":{"dialKeepAlive":"15s","dialTimeout":"30s"}}},"tls":{},"udp":{}} providerName=internal
2025-08-03T02:17:49Z DBG github.com/traefik/traefik/v3/pkg/server/configurationwatcher.go:227 > Configuration received config={"http":{},"tcp":{},"tls":{},"udp":{}} providerName=letsencrypt.acme
It appears it got the right acme challenge configuration, but stopped at attempting to renew the certificate.
The /data/acme.json file is empty.
I have successfully got a certificate using cert-manager. But since Traefik has an integrated letsencrypt support, I think I will give it a try.
Anything am I missing here? Thanks
