Configure clientAuth (mTLS) for docker container

Traefik Traefik v3 (latest)
,
1

Hi there, I want to secure a route to a docker container with clientAuth. With following config in my dynamic config, everything works:

tls:
  stores:
    default:
      defaultCertificate:
        certFile: /certs/xxx.crt
        keyFile: /certs/xxx.key
  options:
    default:
      clientAuth:
        clientAuthType: RequireAndVerifyClientCert
        caFiles:
          - /certs/myCA.pem

But I want to enable clientAuth only for a special container. So I have following config:

tls:
  stores:
    default:
      defaultCertificate:
        certFile: /certs/xxx.crt
        keyFile: /certs/xxx.key
  options:
    mtls:
      clientAuth:
        clientAuthType: RequireAndVerifyClientCert
        caFiles:
          - /certs/myCA.pem

In my docker compose for the special container I have following label:

- traefik.http.routers.xxx.tls.options=mtls@file

In the dashboard it looks good:

Screenshot 2025-03-19 182456
Screenshot 2025-03-19 182456350×347 5.05 KB

But when opening the routed site no client certificate is requested.

2

I found it myself. For others who have the same problem:
My router rule label only contained a PathPrefix. If I add the host, the mtls option works:

traefik.http.routers.xxx.rule=Host(`xxx.com`) && PathPrefix(`/xxx`)
1 Like