I did create an secret with cert-manager which contains the server certificate and the ca certificate. apiVersion: v1 data: ca.crt: LS0tLS... tls.crt: LS0tLS... tls.key: LS0tLS... kind: Secret After adding an IngressRoute with secretName set, I call "openssl s_client" to fetch the certificat…

The name of the secret is also "web-certificate" and the normal certificate from that secret is used correctly only the ca certificate is not used. Is it a problem to use the same name for different "kind" of objects ?

Is it a problem to use the same name for different "kind" of objects ? No, this is not the issue, this is allowed. Thus, in the resources definitions, you have shared, I see no Kubernetes Secret with the name web-certificate. Can you share the full Traefik debug logs?

▶ YAML Config ▶ openssl s_client ▶ Debug Logs

Hello @sl1288 , I overlooked a bit what was the use case you wanted to achieve here. It seems that you want to configure a CA cert for Traefik as a server, to do so you need to leverage the TLSOption resource. It will allow you to configure the CA for client authentication.

I want traefik to send the whole certificate chain to the browser tls.crt + ca.crt. Or do I need to concat all certificates to the tls.crt file in the secret ?

Traefik will not concatenate the cert with the ca to serve a chain, it will only serve the cert. So depending on your use case, you should probably concatenate the chain yourself and provide it in the Kubernetes Secret under the key tls.crt.

CA certificate from secret is not served

Traefik Traefik v2

rtribotte June 15, 2022, 12:11pm 2

Hello @sl1288,

The ingressRoute supports only Kubernetes secrets to be referenced in the TLS section.
In the example IngressRoute you provided, you have referenced a CRD Certificate from CertManager.

Topic		Replies	Views
Import CA certificate for backend TLS connections Traefik v2 kubernetes-ingress	2	3831	December 7, 2021
Ingress not using the kubernetes secret certificate, instead uses default generated Traefik v2 kubernetes-ingress	1	2578	September 2, 2022
IngressRoute with "secretName" field still serves with default certificate Traefik v2 kubernetes-crd	18	5817	January 9, 2020
Traefik's default TLS certificate instead of one from secret Traefik v3 (latest) kubernetes-ingress	1	1223	June 27, 2024
How configure properly to access service 443 who has is own CA Traefik v2 kubernetes-crd , kubernetes-ingress	3	618	February 27, 2020

CA certificate from secret is not served

Related topics