What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Yes. Coolify can serve a certificate you supply instead of an automatically obtained one. The exact method depends on the integrated proxy: Traefik reads a file-based dynamic TLS configuration, while Caddy uses a mounted certificate directory and a route-level TLS label. In both cases, use a PEM certificate with the necessary intermediate chain, a matching unencrypted private key, correct hostname coverage, and secure file permissions.
Antihost offers VPS plans with one-click Coolify, NVMe storage and a 14-day free trial.
After installation, DNS must point the hostname to the server (or a correctly configured CDN), TCP ports 80 and 443 must reach the proxy, and you must verify the certificate actually presented on the live connection. Manually supplied certificates are an operator-managed renewal task; Caddy explicitly does not renew them automatically, and Traefik files should be treated the same way.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchChoose the proxy method before changing anything
Coolify’s default integrated reverse proxy is Traefik, and its documentation is broader. Caddy is an integrated alternative. You can identify the active proxy in the server’s proxy settings. Do not mix the two procedures: Traefik expects files under its mounted /traefik/ path and a Dynamic Configuration, whereas Caddy expects a volume mount to /certs and a TLS label on the existing route.
| Question | Traefik | Caddy |
|---|---|---|
| Where the certificate is configured | Servers > your server > Proxy > Dynamic Configurations; add a YAML file using the file provider. | Servers > your server > Proxy > Configuration; mount a host directory into the Caddy service, then add a route-level label. |
| Container path used by the proxy | /traefik/..., because Coolify mounts /data/coolify/proxy/ there. |
/certs/..., from the explicit Caddy volume mount. |
| How configuration is applied | Traefik watches dynamic configuration and loads the certificate for matching TLS routers. | Restart the proxy after adding the mount, then redeploy the resource after adding the label. |
| Renewal | Files that you supply are an operator-managed workflow; replace them before expiry. | Caddy does not automatically renew a certificate supplied this way. |
| Routing requirement | Keep Coolify’s generated HTTPS router and labels. | Keep every generated routing label and add TLS to the existing HTTPS route. |
If you only need a publicly trusted certificate and do not have a specific organization, private CA, or legacy-certificate requirement, Coolify’s normal automated certificate flow is simpler. Use the custom method when you already control the certificate lifecycle or must present a certificate issued by an internal PKI.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites and certificate checks
Use the correct files
Prepare two files: a PEM-encoded certificate and its matching unencrypted private key. The certificate should contain the required intermediate certificates (the usual full chain), not merely the leaf certificate. Its Subject Alternative Name (SAN) extension must include the exact hostname that users request, such as example.com or app.example.com. A certificate that only names the bare domain will not cover a separate subdomain unless that name or an appropriate wildcard is present in SANs.
The private key must correspond to the certificate. Do not convert it into an encrypted-at-rest key that the proxy cannot unlock during startup; the procedures here assume an unencrypted key file protected by filesystem permissions. Keep the key out of source control, tickets, chat, and Coolify’s dashboard fields.
Plan where the files must exist
A proxy can read only files visible inside its own container. For Traefik, place the host files below /data/coolify/proxy/; Coolify exposes that host directory inside the Traefik container as /traefik/. For Caddy, place files below /data/coolify/proxy/caddy/ and explicitly mount the certificate directory into the Caddy service. The path in the proxy configuration must be the container path, not the host path.
Check network prerequisites
- The DNS record for the HTTPS hostname resolves to the resource server, or to a CDN that forwards traffic correctly to that server.
- TCP ports 80 and 443 are allowed through cloud firewalls, host firewalls, and any upstream load balancer. Port 80 is commonly needed for HTTP routing and certificate-related redirects even when the application is intended to be HTTPS-only.
- The Coolify resource has the same HTTPS hostname configured as the certificate’s SAN.
- The application listens on the internal container port configured for the resource. A valid certificate cannot make an application reachable when the backend port is wrong or closed.
Install a custom certificate with Traefik
These steps apply when Traefik is the proxy selected for the Coolify server.
1. Create a protected certificate directory
On the resource server, create the directory used for custom proxy files:
sudo mkdir -p /data/coolify/proxy/certsCopy the PEM certificate and matching private key to that directory over an encrypted connection. For the example below, the files are named example.com.crt and example.com.key. You may use different names, but the names must match the YAML configuration exactly.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRestrict the key after transfer:
sudo chmod 600 /data/coolify/proxy/certs/example.com.keyApply similarly restrictive ownership and permissions to the certificate directory according to your server’s account model. The key is the sensitive object; never commit it to a repository or paste it into Coolify.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Add a Traefik Dynamic Configuration
In Coolify, open Servers > your server > Proxy > Dynamic Configurations and add a file such as custom-certificates.yaml with this content:
tls:
certificates:
- certFile: /traefik/certs/example.com.crt
keyFile: /traefik/certs/example.com.keyThe host directory /data/coolify/proxy/ is mounted at /traefik/ inside the Traefik container, so the paths in the YAML intentionally begin with /traefik/. A path such as /data/coolify/proxy/certs/example.com.crt will not work from inside the container.
3. Keep Coolify’s generated HTTPS route
Configure the resource with its normal HTTPS domain, for example https://example.com, so Coolify generates the router and service labels. The Dynamic Configuration supplies the certificate; it does not replace the generated routing definition. Do not delete or rebuild the generated labels merely to install the certificate.
Recommended Free Tools
If you run several resources or hostnames, add each certificate to the dynamic configuration with its own certFile and keyFile pair. The certificate still has to cover the hostname selected by the client’s SNI value.
4. Allow Traefik to load the file
Traefik watches dynamic configuration, so a valid file can be loaded without rebuilding application routing. If you change the file name, paths, or certificate contents, allow the proxy to reload and then test the live endpoint. If the proxy does not load the change, inspect Servers > your server > Proxy > Logs for YAML, file-read, or key-parsing errors.
5. Verify the certificate presented on the wire
Open the HTTPS hostname and inspect the issuer, SAN list, and expiration date in the browser. For a command-line check, Coolify documents this form:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null
| openssl x509 -noout -subject -issuer -datesThe -servername value is important: it sends the hostname through TLS SNI, allowing Traefik to select the same certificate a normal browser request would receive. Confirm that the subject/SAN information identifies the intended hostname, the issuer is the expected public or private CA, and the dates are current.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Install a custom certificate with Caddy
Use this procedure when Caddy is the selected Coolify proxy. Caddy’s configuration has two separate parts: making the files visible in the container and attaching them to the existing HTTPS route.
1. Create the Caddy certificate directory
On the resource server, create:
sudo mkdir -p /data/coolify/proxy/caddy/certsTransfer the PEM certificate and matching unencrypted private key over an encrypted connection. Restrict the key:
sudo chmod 600 /data/coolify/proxy/caddy/certs/example.com.keyKeep the key out of repositories, issue trackers, shell transcripts shared with others, and dashboard text fields.
2. Mount the directory into the existing Caddy service
Open Servers > your server > Proxy > Configuration. Edit the existing caddy service and add this volume while preserving every volume already present:
services:
caddy:
volumes:
- /data/coolify/proxy/caddy/certs:/certs:roThe :ro suffix makes the mount read-only inside the container. Do not replace the existing volume list with this single line; removing generated or required mounts can break proxy operation. Save the configuration and choose Restart Proxy so Caddy reads the new mount.
3. Configure the resource’s HTTPS domain
Set the resource domain to an HTTPS URL such as https://example.com before adding the certificate label. Caddy’s label index is tied to the generated HTTPS route, so the route must exist first.
4. Add TLS to the existing route
For a standard application, set label management to Managed manually. Preserve all generated routing labels and add:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
caddy_0.tls=/certs/example.com.crt /certs/example.com.keyUse the index from the existing HTTPS domain label. For example, if the generated label is caddy_1=https://example.com, the TLS label must be caddy_1.tls, not caddy_0.tls. Replace an existing tls value for that route instead of creating a second TLS label. In a Docker Compose resource, put the same label on the service that receives the proxy traffic.
5. Redeploy and test
Save the resource and redeploy it. Then inspect the certificate in a browser or with the OpenSSL command shown earlier. Verify issuer, SAN coverage, and expiration. Check proxy logs for errors indicating that Caddy cannot read the mounted files, parse the key, or apply the route label.
Caddy does not automatically renew manually supplied certificates. Before the expiration date, replace both files with the renewed certificate and matching key, keep the same paths, restart the proxy, and redeploy if the resource configuration requires it. Plan this as a recurring operational task rather than waiting for a browser warning.
How hostname selection affects the certificate
TLS certificate selection is based on the hostname sent by the client, normally through SNI. If the requested name is absent from the certificate’s SANs, the proxy cannot present that certificate as a valid match. Traefik can fall back to a default certificate when there is no SNI or no matching domain, which often looks like “Coolify is serving the wrong certificate.” The first check is therefore the exact hostname in the browser address bar, the resource domain, and the certificate SAN list.
Include every public name that should use the certificate. If users access both a bare domain and a subdomain, both names must be covered explicitly or by a suitable wildcard. A certificate for one environment, such as staging, should not be assumed to cover a production hostname unless that name appears in SANs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verification checklist after deployment
- Resolve the hostname and confirm it reaches the intended server or correctly configured CDN.
- Connect to port 443 with the hostname supplied as SNI.
- Inspect the live certificate’s issuer, SANs, and expiration date.
- Confirm the certificate chain includes required intermediates so clients can build trust.
- Check the proxy logs for file-read, YAML, route-label, or key-parsing errors.
- Load the application through its configured HTTPS domain and confirm the backend responds on the configured internal port.
- Repeat the check from a client that is expected to trust the issuing CA, especially when using a private CA.
Testing the files on disk is not enough. A correct certificate can still be hidden by DNS pointing to another server, a CDN presenting its own edge certificate, a second proxy in front of Coolify, or a route whose hostname does not match the certificate.
Troubleshooting common failures
| Symptom | Likely cause | What to check |
|---|---|---|
| The browser shows an unrelated or default certificate. | The requested hostname is not covered, SNI is absent, DNS reaches another endpoint, or no matching router exists. | Compare the browser hostname with SANs, test with -servername, verify DNS, and keep Coolify’s generated HTTPS route. |
| Traefik reports that the certificate is missing. | The dynamic YAML points to a host path instead of the container path, the file name is wrong, or the file is not under the mounted directory. | Use /traefik/certs/... in YAML, confirm the host files under /data/coolify/proxy/certs, and inspect Proxy > Logs. |
| Caddy cannot read the certificate or key. | The volume mount was not applied, the path in the label is wrong, permissions block access, or the key does not parse. | Confirm the /certs:ro mount, restart the proxy, use /certs/... in the label, and review logs. |
| The application returns a gateway or connection error. | DNS, firewall, ports 80/443, the resource domain, or the application’s internal listening port is incorrect. | Trace the request to the server, allow both ports, and match Coolify’s target port to the port the container actually listens on. |
| The Caddy route stops working after manual label changes. | Generated routing labels were deleted or the TLS label was attached to a new route index. | Restore every generated label, identify the existing HTTPS index, and replace that route’s TLS value. |
| Internal users receive a trust warning. | The certificate was issued by a private CA that the client does not trust. | Distribute the organization’s CA trust chain to managed clients, or use a certificate from a CA trusted by the intended audience. |
| The certificate was valid but has expired. | Manual files have no automatic renewal workflow. | Renew with the issuing CA, replace the certificate and matching key before expiry, restart the proxy, and verify dates again. |
Private CA and organizational certificates
Coolify does not require a paid public certificate. An organization can use a certificate issued by its private CA, provided that the hostname is covered and every intended client trusts that CA. Private trust is a client-side requirement: installing the certificate on the server does not make browsers, mobile devices, API clients, or partner systems trust the issuer.
Include the intermediate chain required by the private PKI. A server that sends only the leaf certificate may work for clients that already cached or separately installed the intermediate, while failing for other clients. Test with the same client populations that will use the service.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Operating certificates across multiple Coolify servers
Traefik’s certificate files must exist on every server whose Traefik proxy serves the domain. Copy the same certificate and matching key to the corresponding /data/coolify/proxy/certs location on each server, add the dynamic configuration on each server, and verify each public endpoint. A certificate installed on one machine does not automatically appear on another proxy.
Apply the same operational discipline to Caddy: every Caddy instance receiving traffic needs the mounted files and route label. If a load balancer distributes requests across servers, test each backend or temporarily direct traffic to one server at a time during rollout so that an old certificate is not mistaken for a proxy-selection problem.
Security and maintenance rules
- Transfer private keys only through encrypted administrative channels.
- Use restrictive permissions such as
chmod 600and limit administrative access to the key directory. - Keep certificate files out of Git repositories, backups visible to broad audiences, support tickets, and chat messages.
- Use an unencrypted key only where the proxy can read it at startup, and rely on filesystem access controls to protect it.
- Record the certificate’s expiration date and issuer in your operational calendar.
- Renew before expiration, replace the certificate and key as a pair, restart or reload the relevant proxy, and test the live endpoint.
- After renewal, verify that the new certificate still contains every required SAN and intermediate certificate.
Which method should you use?
Choose Traefik when you want Coolify’s default proxy, its file-provider model, and dynamic configuration that can be watched for changes. Choose Caddy when your server is already using Caddy and you are comfortable maintaining a proxy volume mount plus route labels. Neither method removes the need for correct DNS, reachable ports, valid routing, secure key handling, and a renewal calendar.
Frequently Asked Questions
Can I use a certificate from my company’s private CA?
Yes. The certificate must cover the Coolify hostname, include the necessary chain, and use a matching private key. Every client that connects must trust the private CA; otherwise it will display a trust warning.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why does Traefik show its default certificate?
Traefik can serve a default certificate when the request has no SNI or when no certificate matches the requested hostname. Check the exact hostname, SANs, DNS destination, and generated HTTPS route.
Will Coolify renew a manually uploaded certificate?
Do not rely on automatic renewal for manually supplied files. Caddy explicitly does not renew them, and Traefik files should be handled as an operator-managed workflow. Replace files before expiration and verify the live certificate.
Do I need to install the certificate on every server?
Yes, when multiple servers can serve the domain. The certificate and private key must exist on every proxy instance that may receive the request.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
