<p>I have a K8s cluster working well, with a domain that has a custom SSL Cert, and all other subdomain use a Let's encrypt wildcard.</p>

<p>Now, I want to add another domain that will use custom SSL Cert, but it doesn't seem to work.</p>

<p>First, I create a configMap with <code>.crt</code> and <code>.key</code> files</p>

<pre><code>kubectl create configmap traefik-sge-certificate --from-file=certificate/sge-prod.crt --from-file=certificate/sge-prod.key --dry-run -o yaml | kubectl apply -f -
</code></pre>

<p>Then I add my certs in <code>traefik.toml</code></p>

<pre><code>traefik.toml:
----
# traefik.toml
defaultEntryPoints = ["http","https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      certFile = "/etc/ene-certificate/api.crt"
      keyFile = "/etc/ene-certificate/api.key"
      [[entryPoints.https.tls.certificates]]
      certFile = "/etc/sge-certificate/sge-prod.crt"
      keyFile = "/etc/sge-certificate/sge-prod.key"

[acme] # Automatically add Let's Encrypt Certificate.
  storage= "/etc/certificate/acme.json"
  email = "julien@company.fr"
   entryPoint = "https"
   onHostRule = true
   caServer = "https://acme-v02.api.letsencrypt.org/directory"
    [acme.dnsChallenge]
    provider = "route53"
    delayBeforeCheck = 0
[[acme.domains]]
  main = "*.company.fr"
</code></pre>

<p>And now deployment:</p>

<pre><code>kind: Deployment
apiVersion: apps/v1
metadata:
  name: traefik-deployment
  labels:
    app: traefik
spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      terminationGracePeriodSeconds: 60
      volumes:
        - name: traefik-certificate
          persistentVolumeClaim:
            claimName: traefik-certificate
        - name: config
          configMap:
            name: traefik-config
        - name: traefik-ene-certificate
          configMap:
            name: traefik-ene-certificate
        - name: traefik-sge-certificate
          configMap:
            name: traefik-sge-certificate
      containers:
      - name: traefik
        image: "traefik:1.7"
        envFrom:
          - secretRef:
              name: traefik-env
        volumeMounts:
          - mountPath: "/etc/traefik/config"
            name: config
          - mountPath: "/etc/certificate"
            name: traefik-certificate
          - mountPath: "/etc/ene-certificate/api.crt"
            name: traefik-ene-certificate
            subPath: api.crt
          - mountPath: "/etc/ene-certificate/api.key"
            name: traefik-ene-certificate
            subPath: api.key           
          - mountPath: "/etc/sge-certificate/sge-prod.crt"
            name: traefik-sge-certificate
            subPath: sge-prod.crt
          - mountPath: "/etc/sge-certificate/sge-prod.key"
            name: traefik-sge-certificate
            subPath: sge-prod.key           

        args:
        - --configfile=/etc/traefik/config/traefik.toml
        - --api
        - --kubernetes
</code></pre>

<p>But when I do that, there is 2 problems:</p>

<ul>
<li>My new app: <a href="https://sge.company.fr" rel="nofollow noreferrer">https://sge.company.fr</a> is using wildcard certificates, instead of custom ones ( the purpose of this operation)</li>
<li>The app that was using the custom certificates api.crt (previously working well with custom SSL cert ) are not using wildcard certs, this is a regression.</li>
</ul>

<p>I checked the traefik logs, and it doesn't seem to have any issue.</p>

<p>What I also don't understand, is where is linked the custom SSL Cert with domain.</p>

<p>Can anybody tell me why this is happening, and how should I fix it ?</p>

<p>PD: I understand I should use secrets instead of configMaps, but first thing first !</p>

Juliatzin
<blockquote>
  <p>What I also don't understand, is where is linked the custom SSL Cert with domain.</p>
</blockquote>

<p>The Cert is issued for a specific domain. So, here is the link. </p>

<p>If you issue your cert for <code>domain1.com</code> and then you try to use it on <code>domain2.com</code>, Traefik will not be able to install it.</p>

<p>My error was to use another domain that the one attached to my certificates.</p>

<p>So, the config is OK, and now I can access the domain with my custom certs</p>

<p>Hope it helps others</p>
