Unable to verify the first certificate - Traefik wildcard certificate - docker

Question

I have traefik "traefik:v2.4.8" as a reverse proxy to docker container.
Everything works fine except the HTTPS request from server or Postman (request from frontend browser is fine)
The error is Unable to verify the first certificate
My workaround is to disable SSL verification on Postman and set NODE_TLS_REJECT_UNAUTHORIZED=0 in other Nodejs app that request to this app
I don't know where the issue is but my company wildcard certs works fine in other project using Nginx as reverse proxy, I think I might misconfigured something in Traefik
I have little knowledge about TLS, HTTPS so I not sure how to troubleshoot this problem
Here is my config
traefik.yml
log:
level: DEBUG
entryPoints:
web-secure:
address: ":443"
web:
address: ":80"
providers:
docker:
exposedByDefault: false
network: docker_network
endpoint: "unix:///var/run/docker.sock"
file:
filename: "dyn.yaml"
watch: true
api:
dashboard: false
accessLog: {}
dyn.yml
tls:
certificates:
- certFile: /etc/certs/certs.crt
keyFile: /etc/certs/certs.key
stores:
default:
defaultCertificate:
certFile: /etc/certs/certs.crt
keyFile: /etc/certs/certs.key
options:
myTLSOptions:
minVersion: VersionTLS12
docker-compose.yml
version: "3.0"
services:
traefik:
image: "traefik:v2.4.8"
container_name: "traefik"
ports:
- "80:80"
- "443:443"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- $PWD/traefik.yaml:/traefik.yaml
- $PWD/dyn.yaml:/dyn.yaml
- $PWD/certs/:/etc/certs/
networks:
default:
external:
name: docker_network
api docker-compose.yml
version: "3"
services:
backend:
build: .
user: "node"
working_dir: /usr/src/app
command: "npm start"
expose:
- 8080
restart: always
labels:
- "traefik.enable=true"
- "traefik.docker.network=docker_network"
- "traefik.http.routers.backend-https.entrypoints=web-secure"
- "traefik.http.routers.backend-https.priority=2"
- "traefik.http.routers.backend-https.middlewares=backend-stripprefix"
- "traefik.http.services.backend.loadbalancer.server.port=8080"
- "traefik.http.routers.backend-https.tls=true"
- "traefik.http.routers.backend-https.tls.domains[0].main=myapp.com"
- "traefik.http.routers.backend-https.tls.domains[0].sans=*.myapp.com"
- "traefik.http.routers.backend-https.tls.options=myTLSOptions#file"
- "traefik.http.routers.backend-https.rule=Host(`myapp.com`) && PathPrefix(`/api`)"
- "traefik.http.middlewares.backend-stripprefix.stripprefix.prefixes=/api"
- "traefik.http.middlewares.backend-http-secured.chain.middlewares=backend-http-redirect-to-https, backend-stripprefix"
- "traefik.http.middlewares.backend-http-redirect-to-https.redirectscheme.scheme=https"
- "traefik.http.routers.backend-http.entrypoints=web"
- "traefik.http.routers.backend-http.rule=Host(`myapp.com`) && PathPrefix(`/api`)"
- "traefik.http.routers.backend-http.priority=2"
- "traefik.http.routers.backend-http.middlewares=backend-http-secured"
networks:
default:
external:
name: docker_network