{"id":"0ca24ebc-daeb-4aa4-980c-c1e037ab471d","task":"Configure Traefik to obtain Let's Encrypt certificates via an ACME certificate resolver using the HTTP-01 challenge, persist state in acme.json, and attach the resolver to an HTTP router.","domain":"doc.traefik.io","steps":["Define entryPoints for HTTP and HTTPS in Traefik's static configuration, e.g. (YAML): entryPoints:\n  web:\n    address: \":80\"\n  websecure:\n    address: \":443\"","Define a certificatesResolvers block naming an ACME resolver, with the required 'acme.email' and 'acme.storage' fields, plus an httpChallenge entryPoint:\ncertificatesResolvers:\n  myresolver:\n    acme:\n      email: you@example.com\n      storage: acme.json\n      httpChallenge:\n        entryPoint: web","Alternatively use the TLS-ALPN-01 challenge instead of HTTP-01 by replacing httpChallenge with 'tlsChallenge: {}' under acme — this requires Traefik be reachable on port 443 rather than 80.","Create/mount a persistent location for the acme.json storage file before starting Traefik (e.g. an empty file or directory backed by a volume) so issued certificates survive container/process restarts.","Attach the resolver to an HTTP router via tls.certResolver, e.g.: http:\n  routers:\n    my-https-router:\n      rule: \"Host(`example.com`)\"\n      service: my-service\n      tls:\n        certResolver: myresolver\nOr via a Docker label: traefik.http.routers.<name>.tls.certresolver=myresolver","Ensure the domain's A/AAAA record points to the Traefik instance, and that port 80 (for httpChallenge) or 443 (for tlsChallenge) is externally reachable by Let's Encrypt.","Restart/deploy Traefik and check its logs for ACME registration and certificate-obtained messages; confirm with 'curl -v https://example.com/' that the served certificate is issued by Let's Encrypt (or R3/E1 intermediate).","Official docs: https://doc.traefik.io/traefik/reference/install-configuration/tls/certificate-resolvers/acme/ , https://doc.traefik.io/traefik/reference/routing-configuration/http/tls/overview/ , https://doc.traefik.io/traefik/expose/docker/advanced/"],"gotchas":["Defining a certificatesResolver in the static config does not activate it anywhere — each router (or entrypoint) must explicitly reference it via tls.certResolver, per the Certificate Resolvers overview page.","acme.storage (commonly acme.json) is required and must point to a persistent path/volume; losing it forces re-issuance of every certificate and can push you toward Let's Encrypt rate limits.","acme.httpChallenge.entryPoint is a required field when using the HTTP-01 challenge, and that entrypoint must be reachable by Let's Encrypt on port 80; tlsChallenge instead requires port 443 be reachable.","The built-in 'acme' resolver stores certificates in a single, non-distributed file — running multiple Traefik replicas against Let's Encrypt this way is not natively HA; the docs recommend a tool like cert-manager for Kubernetes HA setups instead.","Every domain and SAN requested must have an A/AAAA record pointing at Traefik; domains are inferred from router Host() rules unless tls.domains is explicitly set, which takes precedence.","Use acme.caServer to switch to Let's Encrypt's staging directory (https://acme-staging-v02.api.letsencrypt.org/directory) while testing, since the default production caServer is subject to Let's Encrypt's normal rate limits."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T06:04:32.081Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T06:04:32.081Z"},"url":"https://mcp.waymark.network/r/0ca24ebc-daeb-4aa4-980c-c1e037ab471d"}