# Traefik-certs-dumper Traefik-certs-dumper is a self-hosted network services app. Traefik Certs Dumper exports the Let's Encrypt certificates managed by your Traefik reverse proxy so other services can use them. It is open source and self-hosted, installable on Docker Hub and Unraid. Canonical page: https://ourlocalhost.com/app/555/traefik-certs-dumper ## Description Traefik Certs Dumper exports the Let's Encrypt certificates managed by your Traefik reverse proxy so other services can use them. It reads certificates from the local acme.json file or from KV stores (Consul, Etcd, Zookeeper, Boltdb), writes them as flat files or per-domain subdirectories, can watch the source and re-dump when certificates change with an optional hook, and supports Traefik v1, v2, and v3. It is aimed at self-hosters who need to reuse the same TLS certificates in services that cannot read Traefik's own storage. ## Platform availability Available on 1 of 9 platforms: Unraid. ## Health score 68/100 (Good), based on 3 of 4 factors. - Maintained: 93 (last commit 19 days ago) - Popular: 56 (638 GitHub stars) - Easy to install: 35 (1 install platform, install notes, Docker image) ## Links - Docker Hub: https://hub.docker.com/r/ldez/traefik-certs-dumper - GitHub: https://github.com/ldez/traefik-certs-dumper - Unraid: https://ca.unraid.net/apps/traefik-certs-dumper-1y7nkzh1q2icqx?q=traefik-certs-dumper ## Common questions ### Can traefik-certs-dumper run a script when a certificate changes? Yes, use watch mode and pass a --post-hook command or a mounted script, for example sh hook.sh. The hook runs only when the watched data source changes. ### Which Traefik certificate storage backends can it dump? It can read an acme.json file or KV stores such as Consul, Etcd, Zookeeper, and Boltdb. Watch mode is available for the file and for Consul, Etcd, and Zookeeper. ### How do I specify the acme.json file and output directory? Use the file subcommand with --source set to the acme.json path and --dest set to the desired dump directory. Include the matching Traefik version flag, such as --version v3. ### How can I make the dumped certificate and key filenames predictable for another service? Flat output uses the domain as the filename, while --domain-subdir creates a directory per domain. You can also set --crt-name, --key-name, --crt-ext, and --key-ext to produce names like fullchain.crt or privkey.key. ## Alternatives - BunkerWeb: BunkerWeb is a self-hosted, open-source web application firewall and NGINX-based web server that protects services with secure-by-default s… - Caddy: Caddy is an extensible web server and reverse proxy that serves Transport Layer Security (TLS) by default, making it simple to secure and r… - Envoy Gateway: Envoy Gateway is an open-source project that manages Envoy Proxy as a standalone or Kubernetes-based application gateway. - Fossorial Pangolin: Open-source identity-based remote access platform using WireGuard, offering unified management, tunneled connections, granular access contr… - Haproxy: HAProxy is a TCP proxy and a HTTP reverse proxy. - Nginx Proxy Manager: Nginx Proxy Manager is a self-hosted reverse proxy and web server that lets you expose home or small-office applications to the internet wi… - nginx: Nginx is an HTTP web server, reverse proxy, content cache, load balancer, TCP/UDP proxy, and mail proxy server. - npmplus: NPMplus is an improved fork of Nginx Proxy Manager that provides a web interface for managing reverse proxy rules, SSL certificates, and ap… - traefik: Traefik is a modern HTTP reverse proxy and load balancer that integrates with Docker, Kubernetes, and other container orchestrators to conf… - tsdproxy: TSDProxy is a Tailscale proxy for Docker containers that automatically creates Tailscale machines for labeled containers, providing automat… --- Source: Our Local Host (https://ourlocalhost.com/app/555/traefik-certs-dumper), the self-hosted and open-source app directory.