Tag
Since 13 May 2026, the Let's Encrypt tlsserver profile issues 45-day certificates. The default classic profile moves to 64 days on 10 February 2027 and to 45 days on 16 February 2028. I tested certbot, Caddy, Traefik, acme.sh and lego against Pebble, and all five let you choose the profile.
You upgrade Nginx Proxy Manager to 2.16.0 by changing the image tag and recreating the container. It ships no database migrations, and in my test it kept every host, certificate and access list. Back up data and letsencrypt first: rolling back to 2.15 by swapping only the image leaves any path you protect with the new feature unprotected.
Traefik is the default reverse proxy for Docker Swarm: automatic service discovery via labels, Let's Encrypt certificates with DNS challenge, and reusable middleware chains. This guide covers the overlay network, static and dynamic configuration, certificate storage for multi-manager setups, and the production decisions that actually matter.
