Certs Tab

The Certs tab shows TLS certificates managed by Traefik, read from two sources:

• ACME (acme.json) - certificates issued and renewed automatically by Traefik's ACME resolvers (Let's Encrypt, ZeroSSL, etc.)
• File-based (tls.yml) - PEM certificates declared under tls.certificates in any loaded dynamic config file

What it shows

A summary strip counts your certificates, how many expire within 7 and within 30 days, and when the next one expires. Each card below shows the main domain with the issuing resolver underneath (file for PEM certs), the first two additional SANs with a copy button each (the rest behind a +N more), and the expiry date with the days remaining coloured green, amber under 30 days, and red under 7.

Certificates are read-only - they are issued and renewed automatically by Traefik. To revoke or force a renewal, do so via your Traefik configuration.

Enabling the tab

During setup wizard

Toggle Certificates on in the Monitoring step.

After setup

Go to Settings - System Monitoring - Tab Visibility and enable Certs.

Requirements

ACME certificates (acme.json)

Point traefik-manager at your acme.json with the ACME_JSON_PATH environment variable (default: /app/acme.json), or with the acme.json Path field under Settings - System Monitoring - File Paths, which wins over the env var. Mount it read-only (:ro) - traefik-manager never writes to acme.json.

volumes:
  - /path/to/traefik/acme.json:/app/acme.json:ro

Several storage files

Traefik writes one storage file per certificate resolver, so a setup with more than one resolver has more than one file. ACME_JSON_PATH accepts a comma-separated list:

environment:
  - ACME_JSON_PATH=/letsencrypt/ovh.json,/letsencrypt/lan.json
volumes:
  - /path/to/traefik/letsencrypt:/letsencrypt:ro

Or point it at a directory, and every .json file inside is read:

environment:
  - ACME_JSON_PATH=/letsencrypt

Certificates from every file are listed together, each showing the resolver that issued it. A file that is missing or unreadable is reported without hiding the certificates from the others.

This works the same on the Host and on a remote agent.

File-based certificates (tls.yml)

Traefik Manager scans all loaded dynamic config files for tls.certificates entries and reads each certFile PEM directly. This is done on the Host only - a remote agent reports its ACME certificates.

Example tls.yml:

tls:
  certificates:
    - certFile: /etc/traefik/certs/chain.pem
      keyFile: /etc/traefik/certs/key.pem

Cert files must be mounted into the TM container

The certFile paths in your dynamic config refer to paths inside the Traefik container. For Traefik Manager to read those files and display the certificates, the same cert files must also be mounted into the Traefik Manager container at the same path.

# docker-compose.yml
services:
  traefik-manager:
    volumes:
      - /etc/traefik/certs:/etc/traefik/certs:ro  # same path as in tls.yml

If the files are not mounted into TM, the Certs tab will not show file-based certificates even though Traefik itself serves them correctly.

On native Linux installs, make sure Traefik Manager has read access to the cert files:

chmod o+r /etc/traefik/certs/chain.pem

If no certificates can be read at all, the tab shows an "acme.json not mounted" panel with the volume line to add to your compose file. File-based certs, when readable, are shown instead.