{"slug":"traefik-certificates-on-tailscale","title":"Traefik certificates on Tailscale","tags":["tailscale"],"agent_summary":"Last validated: Jan 5, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Traefik certificates on Tailscale\r\n\r\nLast validated: Jan 5, 2026\r\n\r\n[Traefik](https://doc.traefik.io/) simplifies networking complexity while designing, deploying, and operating applications. Starting with\r\nthe release of [Traefik Proxy 3.0 Beta 1](https://github.com/traefik/traefik/blob/master/CHANGELOG.md#v300-beta1-2022-12-05), Traefik Proxy supports Tailscale. When Traefik gets\r\nan HTTPS request for a `*.ts.net` site, it gets the HTTPS certificate from the machine's local Tailscale daemon.\r\n\r\nNo configuration is required for the certificate.\r\n\r\nFor example, you can define a certificate resolver in the [static configuration](https://doc.traefik.io/traefik/getting-started/configuration-overview/#the-static-configuration), and it automatically enables HTTPS:\r\n\r\n[YAML](https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=yaml) [TOML](https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=toml) [CLI](https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=cli)\r\n\r\n```shell\r\ncertificatesResolvers:\r\n    myresolver:\r\n        tailscale: {}\r\n```\r\n\r\nThen, for each router or entrypoint where you want to use it, explicitly reference the\r\nresolver in the [dynamic configuration](https://doc.traefik.io/traefik/getting-started/configuration-overview/#the-dynamic-configuration):\r\n\r\n[YAML](https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=yaml) [TOML](https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=toml)\r\n\r\n```shell\r\nhttp:\r\n  routers:\r\n    routertailscale:\r\n      service: \"myservice\"\r\n      rule: \"Host(`example.foo.ts.net`) && Path(`/tailscale`)\"\r\n      tls:\r\n        certResolver: tailscale\r\n\r\n  services:\r\n    myservice:\r\n      loadBalancer:\r\n        servers:\r\n         - url: \"http://localhost:6060\"\r\n```\r\n\r\nFor complete details, refer to the [Traefik Tailscale documentation](https://doc.traefik.io/traefik/master/https/tailscale) at Traefik's web site.\r\n\r\nFor more information about Traefik, refer to [Traefik Quick Start](https://doc.traefik.io/traefik/getting-started/quick-start).\r\n\r\n![Project Logo](https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed)\r\n\r\nAsk AI\r\n\r\nreCAPTCHA\r\n\r\nRecaptcha requires verification.\r\n\r\nprotected by **reCAPTCHA**\r\n","html":"<h1>Traefik certificates on Tailscale</h1>\n<p>Last validated: Jan 5, 2026</p>\n<p><a href=\"https://doc.traefik.io/\">Traefik</a> simplifies networking complexity while designing, deploying, and operating applications. Starting with\r\nthe release of <a href=\"https://github.com/traefik/traefik/blob/master/CHANGELOG.md#v300-beta1-2022-12-05\">Traefik Proxy 3.0 Beta 1</a>, Traefik Proxy supports Tailscale. When Traefik gets\r\nan HTTPS request for a <code>*.ts.net</code> site, it gets the HTTPS certificate from the machine's local Tailscale daemon.</p>\n<p>No configuration is required for the certificate.</p>\n<p>For example, you can define a certificate resolver in the <a href=\"https://doc.traefik.io/traefik/getting-started/configuration-overview/#the-static-configuration\">static configuration</a>, and it automatically enables HTTPS:</p>\n<p><a href=\"https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=yaml\">YAML</a> <a href=\"https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=toml\">TOML</a> <a href=\"https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=cli\">CLI</a></p>\n<pre><code class=\"language-shell\">certificatesResolvers:\r\n    myresolver:\r\n        tailscale: {}\n</code></pre>\n<p>Then, for each router or entrypoint where you want to use it, explicitly reference the\r\nresolver in the <a href=\"https://doc.traefik.io/traefik/getting-started/configuration-overview/#the-dynamic-configuration\">dynamic configuration</a>:</p>\n<p><a href=\"https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=yaml\">YAML</a> <a href=\"https://tailscale.com/docs/integrations/web-servers/traefik/traefik-certificates?tab=toml\">TOML</a></p>\n<pre><code class=\"language-shell\">http:\r\n  routers:\r\n    routertailscale:\r\n      service: \"myservice\"\r\n      rule: \"Host(`example.foo.ts.net`) &#x26;&#x26; Path(`/tailscale`)\"\r\n      tls:\r\n        certResolver: tailscale\r\n\r\n  services:\r\n    myservice:\r\n      loadBalancer:\r\n        servers:\r\n         - url: \"http://localhost:6060\"\n</code></pre>\n<p>For complete details, refer to the <a href=\"https://doc.traefik.io/traefik/master/https/tailscale\">Traefik Tailscale documentation</a> at Traefik's web site.</p>\n<p>For more information about Traefik, refer to <a href=\"https://doc.traefik.io/traefik/getting-started/quick-start\">Traefik Quick Start</a>.</p>\n<p><img src=\"https://cdn.brandfetch.io/tailscale.com/fallback/lettermark/theme/dark/h/256/w/256/icon?c=1bfwsmEH20zzEfSNTed\" alt=\"Project Logo\"></p>\n<p>Ask AI</p>\n<p>reCAPTCHA</p>\n<p>Recaptcha requires verification.</p>\n<p>protected by <strong>reCAPTCHA</strong></p>\n"}