magnusschult.de is managed in Cloudflare.magnusschult.de stays hosted at domainfactory (Microsoft 365/Outlook) - the DNS migration to Cloudflare must never touch MX records.New A records must be DNS-only (grey cloud icon), not Proxied (orange cloud), during the first certificate issuance.
If Cloudflare is proxying the record when a domain is first pointed at the server, it intercepts the HTTP-01 challenge on port 80 before it reaches Traefik, and the certificate request silently fails. The subdomain will resolve, but you'll get either no HTTPS, or Traefik's own self-signed fallback certificate (CN=TRAEFIK DEFAULT CERT) instead of a real one.
Once a real Let's Encrypt cert has been issued successfully, the record can be switched to Proxied later if wanted - just also switch Cloudflare's SSL/TLS mode to Full (Strict) at that point, or the connection between Cloudflare and the origin server will break.
Run this (works from any machine, doesn't need server access):
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -issuer -subject -dates
issuer= ... Let's Encrypt working correctly.issuer= /CN=TRAEFIK DEFAULT CERT the real cert was never issued. Check the grey-cloud setting first, then check whether the backend container is even healthy (see Troubleshooting: Postgres Credential Resets for one common reason a container never becomes healthy in the first place - Traefik won't attach a cert-bearing router to a backend it considers unhealthy).