Traefik certificates on Tailscale

Last validated: Jan 5, 2026

Traefik simplifies networking complexity while designing, deploying, and operating applications. Starting with the release of Traefik Proxy 3.0 Beta 1, Traefik Proxy supports Tailscale. When Traefik gets an HTTPS request for a *.ts.net site, it gets the HTTPS certificate from the machine's local Tailscale daemon.

No configuration is required for the certificate.

For example, you can define a certificate resolver in the static configuration, and it automatically enables HTTPS:

YAML TOML CLI

certificatesResolvers:
    myresolver:
        tailscale: {}

Then, for each router or entrypoint where you want to use it, explicitly reference the resolver in the dynamic configuration:

YAML TOML

http:
  routers:
    routertailscale:
      service: "myservice"
      rule: "Host(`example.foo.ts.net`) && Path(`/tailscale`)"
      tls:
        certResolver: tailscale

  services:
    myservice:
      loadBalancer:
        servers:
         - url: "http://localhost:6060"

For complete details, refer to the Traefik Tailscale documentation at Traefik's web site.

For more information about Traefik, refer to Traefik Quick Start.

Ask AI

reCAPTCHA

Recaptcha requires verification.

protected by reCAPTCHA