Manually trigger Traefik to generate letsencrypt certificate using API

[hussam-almarzoq]

Do you want to request a feature or report a bug?

Feature

What did you expect to see?

The idea is I want to be able to ask Traefik to generate certificates based on an API call. Our system has a lot of domain names that are dynamically pointed to Traefik, so to make sure we don't exceed letsencrypt we want to manually trigger traefik.

[dtomcej]

If you are going to be manually managing your LE certificates, why not use a tool like Certbot to generate certificates, then just dynamically add them to Traefik?

[hussam-almarzoq]

Actually, I just want to trigger Traefik and let it do the rest. Otherwise, I’ll have to take care of the setup for the challenge.

[jnovack]

I can see OP's purpose, but I think the answer lies in #3653, as it was stated the real issue is "not exceeding Let's Encrypt api limits".

Although, this problem only exists once, on go-live. In which case, I heavily recommend a phased deployment. Add a website (container/backend/etc), then generate it's certificate, test it, repeat.

This becomes VERY easy with acme.OnHostRule = true.

[hussam-almarzoq]

Is it possible to use labels to enable OnHostRule for specific frontend?

[soupdiver]

I came across the same need. My scenario:
I run a GKE cluster with a traefik-ingress-controller.

The traefik-ingress-controller-service creates a LoadBalancer on GCE and routes traffic into traefik and from there it gets forwarded to my services.

The issue: When LoadBalancer is created it has a health check attached. No traffic gets through the LoadBalancer until the HealthCheck is green. Since traefik requests the LE certificates immediately after launch (and does not retry in error case) there is not enough time for the health check to get green and allow initial traffic into the cluster for the http challenge.

Currently I have to kill the pod and hope that the newly created one is ready fast enough to do the challenge.

A wait time for the LE process, a retry or API endpoint to trigger would really help

[porridge]

@soupdiver I think I'm facing the same issue as you. Were you able find any reliable workaround?

[porridge]

FTR, there seems to be a separate issue #2174 for the problem described by @soupdiver above.

[b0r1sp]

Quick workaround:

1. delete either complete acme.json or individual certs inside file
2. restart traefik

[b0r1sp]

Beside the mentioned API-call I'd really wish to see a button (per cert) in the dashboard which allows to force-renew individual certs.

[fireba11]

It would also be handy to have a shell/CLI command to do that.
My current case was i had some issues causing me to restart traefik quite a few times, causing the rate limiter to kick in.
The LE certificate was only used for the traefik dashboard, not for my production but i still had to restart traefik to get it renewed ...

[Fmstrat]

I bet everyone wishes this had been implemented today after the intermediate cert expired. Anyone else stuck in a "now what" moment?

[ptruman]

I deleted acme.json to try to force a regen, but it's only generating one cert (and then I got rate limited).
Nearly all of my routers just have sans defined (which worked before) - only one has a main and that's the only one being requested when I have a blank acme.json file....

[Austreelis]

@ptruman I encountered the same issue, so I replaced acme.json with the following:

{
  "le": {
    "Account": {
      "Email": "mail@example.com",
      "Registration": {
        "body": {
          "status": "invalid",
          "contact": [
            "mailto:mail@examplel.com"
          ]
        }
      }
    }
  }
}

And traefik did correctly re-generate all certificates.

[konstantin-schura]

It will be good to have possibility to manually renew le certs. My certs are valid only for 10 days, it was issue with aws policy, i fixed it and need to check. I need to wait next auto renew. It is no possible to me to remove old ones and restart) It is working server.

[tomMoulard]

Hello @konstantin-schura,

It will be good to have possibility to manually renew le certs. My certs are valid only for 10 days

There is a PR (#8046) that will allow you to set the certificate duration. This feature will be available in the next minor release of Traefik.
In your use case, you'll have to set --certificatesresolvers.myresolver.acme.certificatesduration=240 in order to renew certs with the right timeframes.

[bodomic2]

Thanks for the solution @Austreelis, but I think there is no way to reissue 100+ certificates in one account in so short timeframe anyways...
I feel like bunch of websites will go nuts these days. (came here after a letter about TLS-ALPN-01 validation method revocation)

[darkl0rd]

This is exactly my concern - I have a bunch of certificates in use which will be revoked as per recent mailing and am looking for a way to pre-emptively (in a controlled manner) renew these certificates (without causing downtime); any way to do this?

[bodomic2]

@darkl0rd , LE staff offers some help here - https://community.letsencrypt.org/t/questions-about-renewing-before-tls-alpn-01-revocations/170449/24 - also saying that limit will be 300 orders per 3 hours which is quite high. I remember hitting limit of 50/week, and I'm a bit puzzled by this new information

[darkl0rd]

Thanks for that - my problem is, I run a large scale enterprise grade service - I can't have our customers end up with warnings either; that will cause a sh*tstorm with our support department. I can't remove the existing certificates either, because then I will have downtime, so I am really looking for a way to tell traefik - renew the certificates which are here; regardless of the expiry date.

[bodomic2]

@darkl0rd - I'm quite positive you can feed traefik with information that certificates 'need to be updated 2 days after issuance" - seen this hint somewhere here or there. I'm pretty sure this will solve the problem for you.
PS: please let me know if you find the exact HowTo do that :)

[jgerken]

@darkl0rd I used a workaround with Træfik 1.7 (it should be possible with Træfik 2.X, too), I deleted only the Certificate lines from my acme.json and restarted Træfik. All certificates are renewed then. Downtime is minimal, at most some seconds for the renewal of the certificates. This workaround also gives you control about how many certificates are renewed at once. Not sure if this minimal downtime is acceptable for you or not and yes it is not very handy and Træfik should have a build-in mechanism for this but it was the best I could do in a controlled manner.

[bodomic2]

@jgerken, thanks, this was my idea also.

[patrickbaber]

Maybe that helps: #6418

[darkl0rd]

I really need to avoid -any- downtime - I have 1000's of live connections to remote agents that are processing data. I'm also running 1.7, my config is stored in Consul.

[patrickbaber]

@darkl0rd In this situation, I think the best way is to do the renewal on your own. Use an ACME client and use DNS-01 challenge and get the new certificate. Put the certificate in the correct format into acme.json of Traefik.

As far as I know, Traefik needs a restart to load the file, but you don't have an issue process. I hope you don't have that many certificates 🤞

[ldez]

For people that need help to clean their acme.json file, I quickly created a simple tool to help to remove your certificates from the acme.json (Traefik v2 only).

https://github.com/ldez/traefik-certs-cleaner/

The process:

• run the tool with the right arguments
• copy the content of the generated file to your acme.json file
• restart Traefik

@darkl0rd for Traefik v1, the clean is a bit more complex but there are possibilities.
In all cases, you will have to restart your Traefik instances.

FYI I'm a Traefik maintainer, I'm currently off but I took a few times to create this tool.

[jgerken]

@ldez could the tool be extended so that is does the actual renewal of the certificates? That would allow users to generate a fixed version of the acme.json "offline" and only have the minimal downtime of the Træfik restart? My instances are small and do not require such a solution but I think it would be really helpful for users with large instances.

[ldez]

could the tool be extended so that is does the actual renewal of the certificates?

It's more complex because the only information that I can use is the acme.json file, and the TLS challenge requires exposing a temporary certificate for the domain on 443.

It's not possible to run 2 processes on 443 and a domain cannot point to 2 IPs.

With the DNS challenge, it is possible, but with the TLS challenge, it will not be possible without a proxy in front of the proxy and some complex configuration.

[jgerken]

It's more complex because the only information that I can use is the acme.json file, and the TLS challenge requires exposing a temporary certificate for the domain on 443.

Ah, yes. Didn't think about that. Sorry!

[bodomic2]

I encountered the same issue, so I replaced acme.json with the following:

Struggled some time, trying to use this example, finally, I did this:
Opened acme.json and cleared all the array Certificates: [] - leaving in place my private key and url to my account.
Only doing so it worked.

[ldez]

I'm going to repeat my post because I'm afraid people who need a quick fix won't see it because of the discussion

For people that need help to clean their acme.json file, I quickly created a simple tool to help to remove your certificates from the acme.json (Traefik v2 only).

https://github.com/ldez/traefik-certs-cleaner/

The process:

• run the tool with the right arguments
• copy the content of the generated file to your acme.json file
• restart Traefik

The readme contains examples for all the options (only 3 options).

#3652 (comment)

[benok]

@bodomic2 wrote:

Struggled some time, trying to use this example, finally, I did this:
Opened acme.json and cleared all the array Certificates: [] - leaving in place my private key and url to my account.

This can be done with jq like this.

$ cp -p acme.json acme.json.bk
$ cat acme.json | jq 'del(.letsencrypt.Certificates)' | jq '.letsencrypt |= .+ {"Certificates":[]}' > acme-new.json
$ mv acme-new.json acme.json

And don't forget that acme.json requires 600 permission. (like me :-)

$ chmod 600 acme.json

[brablc]

If you are going to be manually managing your LE certificates, why not use a tool like Certbot to generate certificates, then just dynamically add them to Traefik?

2 years later ... I think this is actually the only reliable way at the moment, I built a drop-in solution for docker swarm: https://github.com/brablc/swarm-certbot-traefik

[nmengin]

Hello there,

This would not make it to our roadmap as we are focused elsewhere. If a community member would like to build it, let us know, and we will work with you to ensure you have all the information needed to merge it.

We prefer to work with our community members at the beginning of the design process to ensure that we are aligned and can move quickly with the review and merge process. Let us know here or create a PR before you start, and we will work with you there.

Don’t forget to check out the contributor docs and link the PR to this issue.