Client Authentication (mTLS) on an entrypoint

Traefik Traefik v2 (latest)
, ,
1

I want to have Client Authentication (mTLS) on an entrypoint (all routers) regardless if the entrypoint is contacted using IP or Hostname. I tried following the documentations found here: https://doc.traefik.io/traefik/https/tls/#client-authentication-mtls However using .default here has the undesired effect of enabling clientauth on all entrypoints, which is not what I want. Also is it impossible to enable mTLS on a route unless there is a rule including host? Using rule = "HostRegexp({host:.+}) && PathPrefix(/whoamica/)" does not work, I get an error saying "No domain found in rule HostRegexp({host:.+}) && PathPrefix(/whoamica/), the TLS options applied for this router will depend on the hostSNI of each request" Any pointers greatly appreciated.

2

Hi @espenmy,

Thanks for your interest in Traefik :slight_smile:
In this case,
I would apply the mtls configuration as the default TLS options configuration and define another TLS options configuration that I would apply on other entrypoints.
As you said, tls options is applied regarding the Host rule and not the HostRegex one.