# Common TLS config for all services **URL:** \ **Category:** Traefik v2\ **Tags:** docker\ **Created:** [June 7, 2023, 4:15pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884 "2023-06-07T16:15:53Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 7, 2023, 4:15pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/1 "2023-06-07T16:15:53Z")
I define custom TLS options in my dynamic config file: ```yml tls: options: intermediate: # https://ssl-config.mozilla.org/#server=traefik&config=intermediate&hsts=false minVersion: VersionTLS12 cipherSuites: - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 ``` Then I want to associate it with all https traffic. So for every service I do this: ```yml labels: - traefik.http.routers.service1.tls=true - traefik.http.routers.service1.tls.options=intermediate@file ``` But I've seen examples which define options in the static config in `docker-compose.yml`. So can someone please confirm that if I do this instead: ```yml command: - --entrypoints.websecure.http.tls=true - --entrypoints.websecure.http.tls.options=intermediate@file ``` ...then that will apply to all services that use `websecure` entrypoint, and I don't need to repeat that for every service? ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [June 8, 2023, 12:10pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/2 "2023-06-08T12:10:23Z")
> [@lonix](#): > > ...then that will apply to all services that use `websecure` entrypoint, and I don't need to repeat that for every service? For every service that entrypoint, correct. An even simpler way is to rename `intermediate` to `default` in the dynamic config then you don't even need that option. ---
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 8, 2023, 12:12pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/3 "2023-06-08T12:12:03Z")
Thank you. Is `default` documented anywhere? I wonder what default settings I would be overriding with mine. ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [June 8, 2023, 12:14pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/4 "2023-06-08T12:14:08Z")
You're welcome. Indeed it is documented: [Traefik TLS Documentation - Traefik](https://doc.traefik.io/traefik/https/tls/#tls-options) First blue box under 'TLS Options' ---
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 8, 2023, 12:17pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/5 "2023-06-08T12:17:39Z")
~~Yes I saw that bit - but it doesn't actually define the default settings.~~ Ah ok, the defaults are defined further down the page, within each section. However the ones I'm using come from Mozilla's "intermediate" suite, which are rock solid (we've used them for years in nginx). So it's not a big issue. ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [June 8, 2023, 12:20pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/6 "2023-06-08T12:20:38Z")
I've used them in the past and it certainly did set the defaults, specifically I've used it to both restrict to TSL1.2 and TLS1.3 using PFS ciphers. ---
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 8, 2023, 12:37pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/7 "2023-06-08T12:37:35Z")
Oh yeah! Mozilla's "intermediate" config (above) just gave me an "A" on [SSL Labs](https://www.ssllabs.com/ssltest). (Might be interesting to also test and compare with traefik's `default` tls settings.) ---
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 8, 2023, 12:51pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/8 "2023-06-08T12:51:35Z")
Only problem is it also detects `TRAEFIK DEFAULT CERT `. Unsure how to disable that. I'll work on that separately. ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [June 8, 2023, 4:35pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/9 "2023-06-08T16:35:31Z")
Spoiler, its not good. IIRC it gets a T or F ---
**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\ **Post date:** [June 8, 2023, 4:36pm UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/10 "2023-06-08T16:36:57Z")
That is an artifact of how they test. You can use [strict sni checking](https://doc.traefik.io/traefik/https/tls/#strict-sni-checking) to deny it. ---
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 10, 2023, 3:11am UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/11 "2023-06-10T03:11:18Z")
I tried the traefik default, and I got an A. How about that. ---
**Author:** ![lonix](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lonix/32/7172_2.png) [@lonix](https://community.traefik.io/u/lonix)\ **Post date:** [June 10, 2023, 3:13am UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/12 "2023-06-10T03:13:19Z")
I enabled strict sni but the default cert is still served. I added a [feature request](https://github.com/traefik/traefik/issues/9945) to the repo for an option to disable this behaviour. Anyone stumbling on this please upvote that issue if it matters to you. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [June 13, 2023, 3:14am UTC](https://community.traefik.io/t/common-tls-config-for-all-services/18884/13 "2023-06-13T03:14:20Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.