Certs Tab

The Certs tab shows TLS certificates managed by Traefik, read from two sources:

• ACME (acme.json) - certificates issued and renewed automatically by Traefik's ACME resolvers (Let's Encrypt, ZeroSSL, etc.)
• File-based (tls.yml) - PEM certificates declared under tls.certificates in any loaded dynamic config file

What it shows

A summary strip counts your certificates, how many expire within 7 and within 30 days, and when the next one expires. Each card below shows the main domain with the issuing resolver underneath (file for PEM certs), the first two additional SANs with a copy button each (the rest behind a +N more), and the expiry date with the days remaining coloured green, amber under 30 days, and red under 7.

Certificates are read-only unless you allow removing a certificate. Traefik issues and renews them. To revoke or force a renewal, do so via your Traefik configuration.

Certificates nothing uses

Traefik renews every certificate in acme.json whether or not a router still needs it, and it never removes the section belonging to a resolver you have deleted. Both show up here.

Flag	Meaning
unused	No router on this server serves a domain this certificate covers
no resolver	The certificate resolver that issued it is not in the static config any more

A wildcard certificate counts as used when a router serves any name it covers, *.example.com for app.example.com. A certificate pre-issued through tls.domains on a route counts as used even though no rule names it, and so does the defaultGeneratedCert in tls.stores. Routes you have switched off still count, because turning one back on with its certificate deleted means a fresh issue.

unused is only ever shown when the picture is complete. If Traefik's API did not answer for every protocol, a config file failed to parse, a router matches hosts by regular expression, or a catch-all router exists that any certificate could serve, the summary strip says so and no certificate is called unused. no resolver needs the static config mounted; without it no resolver is judged.

Removing a certificate

Read-only until you allow it. Both steps below are needed, and until then nothing about removal appears in the interface.

1. Mount acme.json read-write

Change the :ro to :rw. This is the only change to the volume.

volumes:
  - /path/to/traefik/acme.json:/app/acme.json:rw     # was :ro

2. Set a restart method

Already using the Static Config editor?

Then you already have a restart method and this step is done. Step 1 is the only change you need.

Traefik reads acme.json once at startup and rewrites the whole file whenever it saves, so a removal without a restart is undone the next time that happens. Traefik Manager will not offer the button without one.

Traefik Manager talks to a small proxy that only exposes container restart, so it never sees the full Docker socket. Add both services:

services:
  traefik-manager:
    environment:
      - RESTART_METHOD=proxy
      - TRAEFIK_CONTAINER=traefik
      - DOCKER_HOST=tcp://socket-proxy:2375
    networks:
      - traefik-net
      - socket-proxy-net

  socket-proxy:
    image: tecnativa/docker-socket-proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1
      POST: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - socket-proxy-net

networks:
  socket-proxy-net:
    internal: true

CONTAINERS: 1 and POST: 1 are the only permissions needed. The internal: true network keeps the proxy off the internet.

The trade-offs are covered in full under Static config.

Removing

Each ACME certificate then gets a remove button. The selection button in the toolbar turns on checkboxes for removing several at once, with Select unused for the common case. A whole batch costs one Traefik restart.

Removing takes a timestamped backup of acme.json first, edits the file in place so a bind mount stays attached, keeps the mode at 600, leaves the ACME account untouched, and restarts Traefik. Every store is checked before any is changed. If Traefik rewrites the file while a removal is in progress, nothing is written and you are asked to try again. Deleting a route offers to remove its certificate at the same time, when no other route still needs it.

Deleting a certificate a route still needs re-issues it

Traefik requests a fresh certificate for any domain a router still serves. Let's Encrypt allows five identical certificates per week, so repeated removals of the same domains can lock you out until that window clears.

Every removal is listed under Settings - Backups - Certificates, and restoring one puts that copy of acme.json back and restarts Traefik. Retention follows the same setting as the other backups. When two stores share a file name, their backups carry the store's folder name, so each restores into its own store.

This works on agents too. The agent needs its own read-write acme.json mount and its own RESTART_METHOD; the Certs tab reads that from the agent rather than assuming.

Filtering

Filter	Shows
Domain	Certificates covering that registered domain, wildcards included
Unused	Certificates no router on this server serves
No resolver	Certificates issued by a resolver that is gone from the static config
Expiring	Expired, or expiring within 30 days

Search matches the main domain and every SAN. The domain list is built from the store and hides itself when everything sits under one domain.

Enabling the tab

During setup wizard

Toggle Certificates on in the Monitoring step.

After setup

Go to Settings - System Monitoring - Tab Visibility and enable Certs.

Requirements

ACME certificates (acme.json)

Point traefik-manager at your acme.json with the ACME_JSON_PATH environment variable (default: /app/acme.json), or with the acme.json Path field under Settings - System Monitoring - File Paths, which wins over the env var. Mount it read-only (:ro) to view certificates and see which of them nothing uses. To also remove them, follow Removing a certificate above, which needs a read-write mount and a restart method.

volumes:
  - /path/to/traefik/acme.json:/app/acme.json:ro

Several storage files

Traefik writes one storage file per certificate resolver, so a setup with more than one resolver has more than one file. ACME_JSON_PATH accepts a comma-separated list:

environment:
  - ACME_JSON_PATH=/letsencrypt/ovh.json,/letsencrypt/lan.json
volumes:
  - /path/to/traefik/letsencrypt:/letsencrypt:ro

Or point it at a directory, and every .json file inside is read:

environment:
  - ACME_JSON_PATH=/letsencrypt

Certificates from every file are listed together, each showing the resolver that issued it. A file that is missing or unreadable is reported without hiding the certificates from the others.

This works the same on the Host and on a remote agent.

File-based certificates (tls.yml)

Traefik Manager scans all loaded dynamic config files for tls.certificates entries and reads each certFile PEM directly. This is done on the Host only - a remote agent reports its ACME certificates.

Example tls.yml:

tls:
  certificates:
    - certFile: /etc/traefik/certs/chain.pem
      keyFile: /etc/traefik/certs/key.pem

Cert files must be mounted into the TM container

The certFile paths in your dynamic config refer to paths inside the Traefik container. For Traefik Manager to read those files and display the certificates, the same cert files must also be mounted into the Traefik Manager container at the same path.

# docker-compose.yml
services:
  traefik-manager:
    volumes:
      - /etc/traefik/certs:/etc/traefik/certs:ro  # same path as in tls.yml

If the files are not mounted into TM, the Certs tab will not show file-based certificates even though Traefik itself serves them correctly.

On native Linux installs, make sure Traefik Manager has read access to the cert files:

chmod o+r /etc/traefik/certs/chain.pem

If no certificates can be read at all, the tab shows an "acme.json not mounted" panel with the volume line to add to your compose file. File-based certs, when readable, are shown instead.