7

you know traefik is able to do all the Let's Encrypt stuff (request and renew) for your webservices. But traefik stores the requested certificates as a JSON-file, which isn't the common format for certificates.

I want to use the Let's Encrypt certificates also for my mail-server, so I need them in simple format: *.pem or *.crt.

Here my question: Is it possible that traefik stores the Let's Encrypt certificates in a common format?

Thanks for help!

4 Answers 4

8

I'm using jq to do this

export certificate

cat acme.json | jq -r '.Certificates[] | select(.Domain.Main=="'www.example.com'") | .Certificate' | base64 -d > www.example.com.crt

export private key

cat acme.json | jq -r '.Certificates[] | select(.Domain.Main=="'www.example.com'") | .Key' | base64 -d > www.example.com.key


Traefik with Consul as KV store

export JSON containing certificate and private key

consul kv get traefik/acme/account/object | gzip -dc | jq -r '.DomainsCertificate.Certs[] | select(.Domains.Main=="'www.example.com'") | .Certificate' > www.example.com.json

export certificate only

consul kv get traefik/acme/account/object | gzip -dc | jq -r '.DomainsCertificate.Certs[] | select(.Domains.Main=="'www.example.com'") | .Certificate.Certificate' | base64 -D >  www.example.com.crt

export private key only

consul kv get traefik/acme/account/object | gzip -dc | jq -r '.DomainsCertificate.Certs[] | select(.Domains.Main=="'www.example.com'") | .Certificate.PrivateKey' | base64 -D > www.example.com.key

backup Consul

backup

consul kv get -base64 traefik/acme/account/object > backup-base64

restore

cat -s backup-base64 | base64 --decode | consul kv put traefik/acme/account/object -
2

The most popular solution is ldez/traefik-certs-dumper. In case of docker-compose you need something along the following lines:

version: '3'

services:
    traefik:
        image: traefik:1.7
        command:
            --entryPoints='Name:http Address::80'
            --entryPoints='Name:https Address::443 TLS'
            --defaultentrypoints=http,https
            --logLevel=DEBUG
            --docker
            --docker.exposedByDefault=false
            --acme
            --acme.acmeLogging=true
            --acme.entrypoint=https
            --acme.storage=/data/acme.json
            --acme.onHostRule=true
            --acme.httpChallenge.entryPoint=http
        ports:
            - 8001:80
            - 8002:443
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - .:/data

    traefik-certs-dumper:
        image: ldez/traefik-certs-dumper:v2.7.0
        entrypoint: sh -c '
            apk add jq
            ; while ! [ -e /data/acme.json ]
                || ! [ `jq ".Certificates | length" /data/acme.json` != 0 ]; do
                    sleep 1
                ; done
            && traefik-certs-dumper file --watch 
                --source /data/acme.json --dest /data/certs'
        volumes:
            - .:/data

    # test service
    whoami:
        image: containous/whoami
        labels:
            traefik.enable: true
            traefik.frontend.rule: Host:example.com

traefik ports are published to 8001 and 8002. I assume here that you need certificates as separate files because you want to put traefik behind another proxy.

more

4
  • It's the only thing that works thanks! How come that apk add jq is not part of the Dockerfile? There is probably a way to streamline all that muliline command into an entrypoint.sh May 22, 2022 at 18:48
  • 1
    @Firsh-justifiedgrid.com It's been a while since I used traefik and friends, so I'm not sure if jq should be part of the image (you generally don't want to add stuff that is not often needed). But you can certainly slim down the traefik-certs-dumper part by extracting most of it into a Dockerfile. And generally that would be a better way.
    – x-yuri
    May 24, 2022 at 10:12
  • Just had the idea since it's a custom image to begin with and jq and those commands are vital/needed for its operation. Not like it has any other purpose, so why not. May 25, 2022 at 11:07
  • 1
    @Firsh-justifiedgrid.com I understand you think that ldez/traefik-certs-dumper should come with jq preinstalled. To decide it we need to know how often jq is needed with this image. Why? It's one of the docker best practices I'm no judge here since I don't even remember how it all works. You might be right, or not. I'm not sure.
    – x-yuri
    May 25, 2022 at 20:53
1

Disclaimer: I'm new to Traefik, so there might be a better solution than this that I'm not aware of.

What I've done is used a Python script by JayH5 to extract the keys files from the acme.json file.

def read_domain_certs(acme_json_path, domain):
    with open(acme_json_path) as acme_json_file:
        acme_json = json.load(acme_json_file)

    certs_json = acme_json['DomainsCertificate']['Certs']
    domain_certs = [cert['Certificate'] for cert in certs_json
                    if cert['Domains']['Main'] == domain]

    if not domain_certs:
        raise RuntimeError(
            'Unable to find certificate for domain "%s"' % (domain,))
    elif len(domain_certs) > 1:
        raise RuntimeError(
            'More than one (%d) certificates for domain "%s"' % (domain,))

    [domain_cert] = domain_certs
    return (base64.b64decode(domain_cert['PrivateKey']),
            base64.b64decode(domain_cert['Certificate']))

Depending on your use case, you could skip saving the files and load the keys directly from the JSON file using that code. However, if you do need the PEM files, the script does also writes the key contents, if you need the files on disk.

def write_cert(storage_dir, filename, cert_content):
    cert_path = os.path.join(storage_dir, filename)
    with open(cert_path, 'w') as cert_file:
        cert_file.write(cert_content)
    os.chmod(cert_path, 0o600)
0

I'm late to the party but meanwhile there are some dockerized solutions that will extract the certificates for you and watch the acme.json file for changes, e.g. https://github.com/SnowMB/traefik-certificate-extractor (I'm not affiliated in any way with it).

2
  • As always there is an obvious answer :)
    – andig
    Apr 14, 2019 at 17:37
  • Doesn't work for Traefik 2 May 22, 2022 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.