Traefik: Renew certificate

In a Docker installation with Traefik as the reverse proxy (default, see Docker (Recommended) →), the procedure depends on whether Traefik obtains the certificate from Let’s Encrypt itself or serves a static certificate from a certificate authority.

Let’s Encrypt (default) #

In the standard installation, Traefik obtains and renews the Let’s Encrypt certificate automatically; no manual replacement is required. If the renewal fails, the logs of the Traefik container provide details (for example docker compose logs traefik in the /opt/relution directory). In that case, it should be checked whether the DNS record of the External URL points to the server and port 80 is reachable from the internet, because Traefik obtains the certificate via the HTTP challenge on port 80. Port 443 must also be reachable for access to Relution.

Traefik stores the obtained certificates in the file /opt/relution/certs/letsencrypt/acme.json (/letsencrypt/acme.json inside the container).

Static certificates #

The certificate chain (server.pem) and the private key (server.key) of a purchased certificate are first prepared as described in Renew a purchased certificate →.

This requires Traefik to be configured for static certificates: the configuration file relution.static_cert.yaml is located in the /opt/relution/configs/traefik directory, and compose.yaml mounts the ./certs/static directory into the Traefik container. If Let’s Encrypt was used so far, the switch is made as described under Traefik - static Certificates in Docker (Recommended) →.

Traefik reads both files from the /opt/relution/certs/static directory. Before the replacement, the existing files are backed up so that they can be restored in case of problems:

cd /opt/relution/certs/static
sudo cp server.pem server.pem.old
sudo cp server.key server.key.old

The server.pem file is replaced with the new certificate, and server.key as well if a new key pair (new CSR) was used. The private key should only be readable by root (sudo chmod 600 server.key). Traefik is then restarted in the /opt/relution directory:

docker compose restart traefik

Alternatively, all containers can be stopped with docker compose down and started again with docker compose up -d; this also briefly stops Relution and the database, so Relution is unavailable in the meantime.

If Traefik does not deliver the new certificate afterwards, the container logs (docker compose logs traefik) show the cause, for example a faulty certificate file or a key that does not match. In this case, the backed-up files server.pem.old and server.key.old can be copied back until the error is resolved.

Finally, the Relution web interface is opened in the browser and the padlock icon in the address bar is used to check whether the new certificate with the new expiry date is delivered. Whether the complete chain is delivered can additionally be checked, for example, with WhatsMyChainCert →.