Traefik ACME HTTP-01 Certificate Automation: Minimal Architecture Note

Problem

You need Traefik to obtain and renew TLS certificates automatically for services it fronts, without manual certificate handling.

Useful Takeaway

A minimal, production‑ready design uses two entrypoints (HTTP and HTTPS), an ACME provider configured for HTTP‑01 challenges, file‑based certificate storage, and a redirect middleware that forces HTTPS.

Requirements

• Entrypoints reachable from clients: :80 for HTTP and :443 for HTTPS.
• A writable storage backend for the ACME account key and issued certificates (local file system, KV store, or secret manager).
• Outbound network access to the ACME server (e.g., acme-v02.api.letsencrypt.org) on port 443 for the HTTP‑01 challenge.

Minimal Suitable Design

The smallest configuration that satisfies the requirements consists of:

1. Two entrypoints named web (HTTP) and websecure (HTTPS).
2. An ACME provider (letsencrypt) using the HTTP‑01 challenge bound to the web entrypoint.
3. File‑based certificate storage at /etc/traefik/acme.json with proper permissions (600).
4. A redirect middleware (redirect-to-https) that sends every HTTP request to HTTPS.
5. A simple router that terminates TLS at Traefik and forwards to your backend services.

Example Configuration (YAML)

# traefik.yaml
entrypoints:
  web:
    address: ":80"
  websecure:
    address: ":443"

api:
  dashboard: true

certificatesResolvers:
  letsencrypt:
    acme:
      email: ${ACME_EMAIL}
      storage: acme.json          # file‑based storage
      httpChallenge:
        entrypoint: web

http:
  middlewares:
    redirect-to-https:
      redirectScheme:
        scheme: https
        permanent: true
  routers:
    http-catchall:
      rule: HostRegexp(`{host:.+}`)
      entrypoints: web
      middlewares: redirect-to-https
      service: noop@internal
    https-service:
      rule: Host(`example.com`)  # replace with your domain
      entrypoints: websecure
      tls:
        certResolver: letsencrypt
      service: your-backend@internal

services:
  your-backend:
    loadBalancer:
      servers:
        - url: http://127.0.0.1:8080

Trust and Data Boundaries

Traefik trusts the ACME server to prove domain ownership via the HTTP‑01 challenge.
The private key for the ACME account and the generated TLS private keys are kept only inside the Traefik process; they are never transmitted outside.
All external trust is limited to the ACME endpoint; traffic to backends is terminated at Traefik, so the backend sees plain HTTP (or can be configured with mutual TLS separately).

Operational Checks

Enable the built‑in /ping or Prometheus /metrics endpoint for liveness probing.
Monitor logs for lines containing "ACME" and "certificate obtained"; absence of errors indicates successful renewal.
Set an alert on certificate expiry (e.g., using Traefik Pilot or an external exporter that reads acme.json).
Verify that the storage file remains writable and backed up; a simple check is stat -c %a acme.json expecting 600.

Failure Modes

Rate limiting: Let's Encrypt enforces limits on registrations and certificates per domain. Exceeding them blocks renewals. Mitigation: use the staging ACME server for testing, stagger renewals, or consolidate multiple subdomains under a single certificate.
Storage unavailability: If acme.json becomes unreadable or the file system is read‑only, Traefik cannot load or renew certificates. Existing TLS connections continue until the current certificate expires, after which new handshakes fail.
Clock skew: ACME validation includes timestamps; a host clock offset of more than a few seconds causes challenge failures. Ensure NTP synchronization on the host running Traefik.

Conditions That Would Change the Design

Need for wildcard certificates → switch to DNS‑01 challenge and integrate with your DNS provider’s API.
High availability requirement → deploy multiple Traefik replicas with a shared KV store (Consul, etcd) for the ACME storage backend.
Strict internal policies forbidding outbound ACME access → use an internal PKI with cert‑manager or HashiCorp Vault and disable the ACME resolver.
Requirement to terminate TLS at the backend (e.g., for end‑to‑end encryption) → remove the tls section from the router and configure passthrough.