Common TLS config for all services

Traefik Traefik v2
1

I define custom TLS options in my dynamic config file:

tls:
  options:
    intermediate:    # https://ssl-config.mozilla.org/#server=traefik&config=intermediate&hsts=false
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
        - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305

Then I want to associate it with all https traffic. So for every service I do this:

labels:
  - traefik.http.routers.service1.tls=true
  - traefik.http.routers.service1.tls.options=intermediate@file

But I've seen examples which define options in the static config in docker-compose.yml.

So can someone please confirm that if I do this instead:

command:
  - --entrypoints.websecure.http.tls=true
  - --entrypoints.websecure.http.tls.options=intermediate@file

...then that will apply to all services that use websecure entrypoint, and I don't need to repeat that for every service?

2

For every service that entrypoint, correct.

An even simpler way is to rename intermediate to default in the dynamic config then you don't even need that option.

1 Like
3

Thank you.

Is default documented anywhere? I wonder what default settings I would be overriding with mine.

4

You're welcome.

Indeed it is documented: Traefik TLS Documentation - Traefik

First blue box under 'TLS Options'

1 Like
5

Yes I saw that bit - but it doesn't actually define the default settings. Ah ok, the defaults are defined further down the page, within each section.

However the ones I'm using come from Mozilla's "intermediate" suite, which are rock solid (we've used them for years in nginx). So it's not a big issue.

6

I've used them in the past and it certainly did set the defaults, specifically I've used it to both restrict to TSL1.2 and TLS1.3 using PFS ciphers.

1 Like
7

Oh yeah! Mozilla's "intermediate" config (above) just gave me an "A" on SSL Labs.

(Might be interesting to also test and compare with traefik's default tls settings.)

8

Only problem is it also detects TRAEFIK DEFAULT CERT . Unsure how to disable that.

I'll work on that separately.

9

Spoiler, its not good. IIRC it gets a T or F

10

That is an artifact of how they test. You can use strict sni checking to deny it.

11

I tried the traefik default, and I got an A. How about that.

12

I enabled strict sni but the default cert is still served.

I added a feature request to the repo for an option to disable this behaviour. Anyone stumbling on this please upvote that issue if it matters to you.

13

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.