I have raised this exact query at stackoverflow as well, as, interestingly, "Traefik" and "Kubernetes-Ingress" tags are absent on ServerFault, but present on StackoVerflow.
When I only add the TLS secret to the Ingress, Traefik serves it's default certificate.
kind: Ingress spec: rules: .... tls: - secretName: ingress-mgt-server-keys
Only when I mount the secret and add below parameter, does Traefik start serving the real certificate.
Are TLS secrets to be define in both, Traefik Ingress and Ingress-controller? This forces me to repeat the keys as secrets to all the ingress namespaces as well as the ingress-controller namespace.