Repository: traefik/traefik (language: go)

Issue:
Missing `traefik_tls_certs_not_after` metric for default certificate
### Welcome!

- [X] Yes, I've searched similar issues on [GitHub](https://github.com/traefik/traefik/issues) and didn't find any.
- [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any.

### What did you do?

I deploy latest Traefik helm chart and use a default wildcard certificate for serving ingresses & ingressroutes (they all works as expected)
Then I found that I have all other metrics but not `traefik_tls_certs_not_after` one.

### What did you see instead?

No `traefik_tls_certs_not_after` value is collected by Prometheus.

### What version of Traefik are you using?

`Image:         traefik:2.9.4`

### What is your environment & configuration?

```yaml

  fullnameOverride: traefik-private

  deployment:
    enabled: true
    kind: DaemonSet

  providers:
    kubernetesCRD:
      enabled: true
      allowCrossNamespace: true
      allowExternalNameServices: true

    kubernetesIngress:
      enabled: true
      allowExternalNameServices: true
      allowEmptyServices: false
      ingressClass: traefik-private

  metrics:
    prometheus:
      entryPoint: metrics

  tracing: {}
  ports:
    web:
      port: 8000
      expose: true
      exposedPort: 80
      protocol: TCP
      proxyProtocol:
        #trustedIPs: []
        insecure: true
    websecure:
      port: 8443
      expose: true
      exposedPort: 443
      protocol: TCP
      http3:
        enabled: true
        
      tls:
        enabled: true
        # this is the name of a TLSOption definition
        options: ""
        certResolver: ""
        domains: []
        
      proxyProtocol:
        #trustedIPs: []
        insecure: true

      middlewares: []

  tlsStore:
    default:
      defaultCertificate:
        secretName: wildcard-mydomain-com

  service:
    enabled: true
    type: LoadBalancer
    spec:
      externalTrafficPolicy: Local
```

Add more configuration information here.


### If applicable, please paste the log output in DEBUG level

_No response_


Discussion / hints:

Fix patch:
diff --git a/cmd/traefik/traefik.go b/cmd/traefik/traefik.go
index ca685d5752..c0e78d6eb4 100644
--- a/cmd/traefik/traefik.go
+++ b/cmd/traefik/traefik.go
@@ -278,7 +278,7 @@ func setupServer(staticConfiguration *static.Configuration) (*server.Server, err
 		tlsManager.UpdateConfigs(ctx, conf.TLS.Stores, conf.TLS.Options, conf.TLS.Certificates)
 
 		gauge := metricsRegistry.TLSCertsNotAfterTimestampGauge()
-		for _, certificate := range tlsManager.GetCertificates() {
+		for _, certificate := range tlsManager.GetServerCertificates() {
 			appendCertMetric(gauge, certificate)
 		}
 	})
diff --git a/pkg/tls/tlsmanager.go b/pkg/tls/tlsmanager.go
index 91fd6402f9..fb2be8efeb 100644
--- a/pkg/tls/tlsmanager.go
+++ b/pkg/tls/tlsmanager.go
@@ -223,24 +223,43 @@ func (m *Manager) Get(storeName, configName string) (*tls.Config, error) {
 	return tlsConfig, err
 }
 
-// GetCertificates returns all stored certificates.
-func (m *Manager) GetCertificates() []*x509.Certificate {
+// GetServerCertificates returns all certificates from the default store,
+// as well as the user-defined default certificate (if it exists).
+func (m *Manager) GetServerCertificates() []*x509.Certificate {
 	var certificates []*x509.Certificate
 
-	// We iterate over all the certificates.
-	for _, store := range m.stores {
-		if store.DynamicCerts != nil && store.DynamicCerts.Get() != nil {
-			for _, cert := range store.DynamicCerts.Get().(map[string]*tls.Certificate) {
-				x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
-				if err != nil {
-					continue
-				}
+	// The default store is the only relevant, because it is the only one configurable.
+	defaultStore, ok := m.stores[DefaultTLSStoreName]
+	if !ok || defaultStore == nil {
+		return certificates
+	}
 
-				certificates = append(certificates, x509Cert)
+	// We iterate over all the certificates.
+	if defaultStore.DynamicCerts != nil && defaultStore.DynamicCerts.Get() != nil {
+		for _, cert := range defaultStore.DynamicCerts.Get().(map[string]*tls.Certificate) {
+			x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
+			if err != nil {
+				continue
 			}
+
+			certificates = append(certificates, x509Cert)
 		}
 	}
 
+	if defaultStore.DefaultCertificate != nil {
+		x509Cert, err := x509.ParseCertificate(defaultStore.DefaultCertificate.Certificate[0])
+		if err != nil {
+			return certificates
+		}
+
+		// Excluding the generated Traefik default certificate.
+		if x509Cert.Subject.CommonName == generate.DefaultDomain {
+			return certificates
+		}
+
+		certificates = append(certificates, x509Cert)
+	}
+
 	return certificates
 }
 


Test patch: