← Directory

traefik-certs-dumper

Dump Let's Encrypt certificates from Traefik.

  • Network Services
  • Security
  • Tools & Utilities
Dump Let's Encrypt certificates from Traefik. Support Traefik v1, v2, and v3. Please check & modify post arguments. Refer https://github.com/ldez/traefik-certs-dumper/blob/main/docs/traefik-certs-dumper_file.md

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

68/100 Good

Maintained
93last commit 13 days ago
Popular
56638 GitHub stars
Easy to install
351 install platform, install notes, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today, links checked 15 days ago

GitHub stars
638
Open issues
14
Last commit
2026-10-02
Latest release
v2.11.4
Activity
declining

Checked 8 days ago - source: GitHub (ldez/traefik-certs-dumper)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked 17 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Set ports 80 and 443 Tell Traefik to listen on port 80 for plain web traffic and port 443 for secure HTTPS traffic. If these are not set, browsers and other services may not be able to reach your apps. source
  • Enable the provider that finds your apps Enable the provider (the part Traefik uses to discover running services), such as Docker, in its startup settings. Without it, Traefik starts but has no routes or certificates to use for your apps. source
  • Skip v2-only settings If you copied a Traefik v2 config, remove v2-only settings like the Pilot token and InfluxDB v1 metrics before starting v3. They are unsupported and can prevent Traefik from starting. source

Fetched 17 days ago - each note links to its source

Alternatives (10)

  • BunkerWeb - BunkerWeb is a self-hosted, open-source web application firewall and NGINX-based web server that protects services with secure-by-default s…
  • Caddy - Caddy is an extensible web server and reverse proxy that serves Transport Layer Security (TLS) by default, making it simple to secure and r…
  • Envoy Gateway - Envoy Gateway is an open-source project that manages Envoy Proxy as a standalone or Kubernetes-based application gateway.
  • Fossorial Pangolin - Open-source identity-based remote access platform using WireGuard, offering unified management, tunneled connections, granular access contr…
  • Haproxy - HAProxy is a TCP proxy and a HTTP reverse proxy.
  • Nginx Proxy Manager - Nginx Proxy Manager is a self-hosted reverse proxy and web server that lets you expose home or small-office applications to the internet wi…
  • nginx - Nginx is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy, and mail proxy server.
  • npmplus - NPMplus is an improved fork of Nginx Proxy Manager that provides a web interface for managing reverse proxy rules, SSL certificates, and ap…
  • traefik - Traefik is a modern HTTP reverse proxy and load balancer that integrates with Docker, Kubernetes, and other container orchestrators to conf…
  • tsdproxy - TSDProxy is a Tailscale proxy for Docker containers that automatically creates Tailscale machines for labeled containers, providing automat…

Checked 3 days ago - source: AlternativeTo

Common questions

Can traefik-certs-dumper run a script when a certificate changes?

Yes, use watch mode and pass a --post-hook command or a mounted script, for example sh hook.sh. The hook runs only when the watched data source changes.

Which Traefik certificate storage backends can it dump?

It can read an acme.json file or KV stores such as Consul, Etcd, Zookeeper, and Boltdb. Watch mode is available for the file and for Consul, Etcd, and Zookeeper.

How do I specify the acme.json file and output directory?

Use the file subcommand with --source set to the acme.json path and --dest set to the desired dump directory. Include the matching Traefik version flag, such as --version v3.

How can I make the dumped certificate and key filenames predictable for another service?

Flat output uses the domain as the filename, while --domain-subdir creates a directory per domain. You can also set --crt-name, --key-name, --crt-ext, and --key-ext to produce names like fullchain.crt or privkey.key.

Answers sourced from github.com

Community

Collected 11 days ago - public community threads