Repository: traefik/traefik (language: go)

Issue:
Panic on self-signed certificates
### Welcome!

- [X] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.

### What did you do?

I tried to configure the generated self-signed certificates.

### What did you see instead?

Nothing from use side. Panic in logs.    
This apparently happened due to incorrect certificates. But I'd rather make a mistake than panic. After the certificates were regenerated, it started working.

### What version of Traefik are you using?

v2.6.6

### What is your environment & configuration?

```yaml
# Dynamic configuration
tls:
  stores:
    default:
      defaultCertificate:
        certFile: "/cert/nginx-selfsigned.crt"
        keyFile: "/cert/nginx-selfsigned.key"

```

And as params:
```
- --providers.file.directory=/conf/
- --providers.file.watch=true
```

### If applicable, please paste the log output in DEBUG level

```
Serving default certificate for request: \"localhost\"
http: panic serving 10.0.0.2:56780: runtime error: invalid memory address or nil pointer dereference
goroutine 121 [running]:
net/http.(*conn).serve.func1()
	net/http/server.go:1802 +0xb9
panic({0x2fe5ea0, 0x5de3540})
	runtime/panic.go:1047 +0x266
github.com/traefik/traefik/v2/pkg/tls.(*Manager).Get.func1(0xc0005cfee0)
	github.com/traefik/traefik/v2/pkg/tls/tlsmanager.go:175 +0x2c3
crypto/tls.(*Config).getCertificate(0xc000cbf200, 0xc0005cfee0)
	crypto/tls/common.go:1042 +0x42
crypto/tls.(*serverHandshakeStateTLS13).pickCertificate(0xc000149990)
	crypto/tls/handshake_server_tls13.go:362 +0x66
crypto/tls.(*serverHandshakeStateTLS13).handshake(0xc000149990)
	crypto/tls/handshake_server_tls13.go:54 +0x53
crypto/tls.(*Conn).serverHandshake(0xc000daf500, {0x3fce158, 0xc000ce0a40})
	crypto/tls/handshake_server.go:54 +0xd0
crypto/tls.(*Conn).handshakeContext(0xc000daf500, {0x3fce200, 0xc00061c4e0})
	crypto/tls/conn.go:1445 +0x3d1
crypto/tls.(*Conn).HandshakeContext(...)
	crypto/tls/conn.go:1395
net/http.(*conn).serve(0xc000cd5ae0, {0x3fce200, 0xc0001362a0})
	net/http/server.go:1818 +0x230
created by net/http.(*Server).Serve
	net/http/server.go:3034 +0x4e8
```


Discussion / hints:

Fix patch:
diff --git a/pkg/tls/tlsmanager.go b/pkg/tls/tlsmanager.go
index 50e809e8aa..961b1d8e30 100644
--- a/pkg/tls/tlsmanager.go
+++ b/pkg/tls/tlsmanager.go
@@ -171,6 +171,13 @@ func (m *Manager) Get(storeName, configName string) (*tls.Config, error) {
 			return nil, nil
 		}
 
+		if store == nil {
+			log.WithoutContext().Errorf("TLS: No certificate store found with this name: %q, closing connection", storeName)
+
+			// Same comment as above, as in the isACMETLS case.
+			return nil, nil
+		}
+
 		log.WithoutContext().Debugf("Serving default certificate for request: %q", domainToCheck)
 		return store.DefaultCertificate, nil
 	}


Test patch:
diff --git a/pkg/tls/tlsmanager_test.go b/pkg/tls/tlsmanager_test.go
index 63f13fe175..f06d0ab94b 100644
--- a/pkg/tls/tlsmanager_test.go
+++ b/pkg/tls/tlsmanager_test.go
@@ -171,6 +171,36 @@ func TestManager_Get(t *testing.T) {
 	}
 }
 
+func TestManager_Get_GetCertificate(t *testing.T) {
+	testCases := []struct {
+		desc                 string
+		expectedGetConfigErr require.ErrorAssertionFunc
+		expectedCertificate  assert.ValueAssertionFunc
+	}{
+		{
+			desc:                 "Get a default certificate from non-existing store",
+			expectedGetConfigErr: require.Error,
+			expectedCertificate:  assert.Nil,
+		},
+	}
+
+	tlsManager := NewManager()
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			config, err := tlsManager.Get("default", "foo")
+			test.expectedGetConfigErr(t, err)
+
+			certificate, err := config.GetCertificate(&tls.ClientHelloInfo{})
+			require.NoError(t, err)
+			test.expectedCertificate(t, certificate)
+		})
+	}
+}
+
 func TestClientAuth(t *testing.T) {
 	tlsConfigs := map[string]Options{
 		"eca": {