Explain the lifecycle of a Let's Encrypt certificate managed by Traefik?

The lifecycle begins when a router references a certificate resolver in its TLS settings for a domain that has no existing valid certificate on file; Traefik then initiates an ACME order with Let's Encrypt for that domain.

Depending on the configured challenge (HTTP-01, TLS-ALPN-01, or DNS-01), Traefik proves domain ownership: serving a token over HTTP, responding to a special TLS handshake, or creating a DNS TXT record, respectively, then Let's Encrypt validates that proof and issues the certificate.

The issued certificate and its private key are persisted to the resolver's configured storage, commonly acme.json or a KV store entry, and from that point on, the router uses this stored certificate for every matching TLS handshake, without re-requesting it from Let's Encrypt.

Traefik tracks each certificate's expiry in the background and automatically starts a renewal well before the 90-day Let's Encrypt certificates expire, repeating the same challenge-and-store process; if renewal fails repeatedly (a broken DNS API credential, for instance), the existing certificate keeps serving traffic until it actually expires, giving the operator a window to fix the underlying issue before an outage occurs.