SSL passthrough with Traefik

Question

I need to send the SSL connections directly to the backend, not decrypt at my Traefik. The backend needs to receive https requests.

I tried the traefik.frontend.passTLSCert=true option but getting "404 page not found" error when I access my web app and also get this error on Traefik container

traefik       | time="2018-09-16T10:47:41Z" level=error msg="Failed to create TLSClientConfig: no TLS provided"
traefik       | time="2018-09-16T10:47:41Z" level=error msg="Failed to create RoundTripper for frontend frontend-Host-dev-mydomain-com-0: no TLS provided"
traefik       | time="2018-09-16T10:47:41Z" level=error msg="Skipping frontend frontend-Host-dev-mydomain-com-0..."

Could you suggest any solution? Thank you.

I'm using Traefik version 1.6.6.

Here is my docker-compose.yml for the app container.

version: '3'
services:
  app:
    image: webdevops/php-nginx-dev:7.2
    networks:
      - proxy
    volumes:
      - ./:/app
      - ../traefik/ssl/*.mydomain.com.crt:/opt/docker/etc/nginx/ssl/server.crt
      - ../traefik/ssl/*.mydomain.com.key:/opt/docker/etc/nginx/ssl/server.key
    environment:
      - WEB_DOCUMENT_ROOT=/app
    labels:
      - traefik.enable=true
      - traefik.frontend.rule=Host:dev.mydomain.com
      - traefik.docker.network=proxy
      - traefik.port=443
networks:
  proxy:
    external: true

The docker-compose.yml of my Traefik container.

version: "3"
services:
  traefik:
    image: traefik
    container_name: traefik
    command:
      - --api
      - --docker
      - --docker.exposedbydefault=false
    restart: always
    ports:
      - 80:80
      - 443:443
    networks:
      - proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.toml:/traefik.toml
      - ./ssl:/sslcert
networks:
  proxy:
    external: true

Finally, my traefik.toml file.

debug = true
logLevel = "ERROR"
defaultEntryPoints = ["http","https"]

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]
    [[entryPoints.https.tls.certificates]]
      certFile = "/sslcert/*.mydomain.com.crt"
      keyFile = "/sslcert/*.mydomain.com.key"

[retry]

score 4 · Answer 1 · answered Apr 26 '19 at 13:12

Traefik now has TCP support in its new 2.0 version - which is still in alpha at this time (Apr 2019).

See PR https://github.com/containous/traefik/pull/4587
and the release notes of v2.0.0-alpha1 at https://github.com/containous/traefik/releases/tag/v2.0.0-alpha1 showing this TCP support PR being included

Hence once 2.0 is released (probably within 2-3 months), HTTPS passthrough will become possible.

smaftoul · Accepted Answer · 2020-08-03T12:07:20.530

3

Answer for traefik 1.0 (outdated)

passTLSCert forwards the TLS Client certificate to the backend, that is, a client that sends a certificate in the TLS handshake to prove it's identity.

Traefik is an HTTP reverse proxy. To establish the SSL connection directly with the backend, you need to reverse proxy TCP and not HTTP, and traefik doesn't (yet ?) support tcp (but there are issues for that on github).

Traefik won't fit your usecase, there are different alternatives, envoy is one of them.

edited Aug 03 '20 at 12:07

answered Sep 17 '18 at 11:50

smaftoul

2,375
17
14

Thanks for your suggestion. I will try the envoy to find out if it fits my use case. – Quinn Wynn Sep 17 '18 at 16:00
Does the envoy support containers auto detect like Traefik? – Quinn Wynn Sep 17 '18 at 16:55
envoy needs discovery through KV stores / APIs (sorry, I don't know it very well). – smaftoul Sep 18 '18 at 13:22
anyway, your question is answered, you probably should create other questions ... – smaftoul Sep 18 '18 at 13:23
Thank you. I will try it. Thanks for reminding me. A little bit off-topic :p – Quinn Wynn Sep 18 '18 at 16:37
You can do it in version 2.0 - https://medium.com/@nithinmeppurathu/traefik-2-0-tls-passthrough-with-docker-ab-f560072a1bb – Nithin Meppurathu Sep 21 '19 at 00:29
traefik supports passthrough – pyramation Jun 24 '20 at 02:09

score 3 · Answer 3 · answered Jun 22 '20 at 08:54

3

The new passthrough for TCP routers is already available: https://docs.traefik.io/routing/routers/#passthrough

answered Jun 22 '20 at 08:54

dmaixner

808
1
7
16

SSL passthrough with Traefik

3 Answers3

Linked