Confusion about tls certficates, stores and how they fit together

Traefik Traefik v2
1

Hi,

after searching the docs and this forum i am still confused about the usage of predefined tls certificates referenced with "dynamic" file provider.

Also i'm not getting whats the deal with tls.stores and how to use it.

For Example:
If i have a wildcard certifacte and a tls key file that are referenced by "dynamic_conf.toml" with file provider.
All i have to write is this:

[[tls.certificates]]
   certFile = "/opt/traefik/certs/fullchain.crt"
   keyFile = "/opt/traefik/certs/tls.key"

and

...
traefik.http.routers.websecure.tls=true
...

to "activate" usage of that certificate.

But that leaves me to some questions:

  • what if i define many certificates for different services - how does traffic know which one to use?
  • can i reference them from labels to dynamic_conf.toml ?
  • what about those stores ?
  • where do they point ?
  • how to reference them ?
  • and what are they good for if i can simply leave them out of config and got still everything working?
1 Like
2

Hi @lachnerd, I'm trying to answer with the best of my abilities and understanding:

When Traefik loads the dynamic configuration from the file provider, assuming you're using the TOML syntax for the dynamic configuration, it behaves like this: for each [[tls.certificates]] directive, it adds the defined certificate (and it's asscoiated key) to the default store. It also extracts the subject (and eventually the alternative subjects) from the certificate to identify the domains covered by this certificate.

=> When enabling "TLS" on a router, any request handled by this router is parsed by Traefik which extracts the host. Then, Traefik searches in the certificate store if there is certificate with a subject matching this host. If one is found, then it is used. If no certificate is used, then Traefik falls back to the "Default autogenerated self signed certificate". The behavior is the same with let's Encrypt any certificate requested successfully is added to this default store.

Yes of course, by using the right TOML syntax. For instance:

# dynamic_conf.toml
# ...

# Add Certificate for domainA.com (can be wildcard, single subject, or even with SAN)
[[tls.certificates]]
   certFile = "/certs/domainA.com/fullchain.crt"
   keyFile = "/certs/domainA.com/tls.key"

# Add Certificate for domainB.com (can be wildcard, single subject, or even with SAN)
[[tls.certificates]]
   certFile = "/certs/domainB.com/fullchain.crt"
   keyFile = "/certs/domainB.com/tls.key"

# etc.

Please note that with Traefik v2.0, the YML syntax is also supported: in this particular case, it might be easier to get the concept of "collection of certificates":

# Dynamic configuration

tls:
  certificates:
    - certFile: /certs/domainA.com/fullchain.crt
      keyFile: /certs/domainA.com/tls.key
    - certFile: /certs/domainB.com/fullchain.crt
      keyFile: /certs/domainB.com/tls.key

Don't worry about the stores. You can see this as a "black box" thing. For now (Traefik v2.0), only the "default" store is available. This is a remnant of the foundation changes from 1.7 to 2.0. I can't say if a feature will come out from this, but consider you're using the default store, and don't overload your config with this.

Does it help?

2 Likes
3

One of the problem with certs in v1 was that for highly available setup you could store them in consul or etcd. At the same time, the size of a value in those stores is ususally small. This resulted in the fact that only about a hundred certs would fit into the store and not more.

This was a very common complain. Unfortunately, this was very hard to fix due to how atomicity is handled in those key-value stores.

I think that traefik team might consider a better support for those HA scenarions in Entrerprise version of traefik. If so, aparently alternate stores from the default are needed for the same reason they existed in v1 - you cannot share the same acme.json between several instances of traefik, it will not be very stable due to concurrency. This is the idea behind the stores.

1 Like
4

wow, thx a lot - that made everything much much clearer!

I think the main irritating aspect here was the docs for stores

1 Like