# Connecting to docker socket using client TLS certs?

**URL:** <https://community.traefik.io/t/connecting-to-docker-socket-using-client-tls-certs/9469>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [January 27, 2021, 12:57pm UTC](https://community.traefik.io/t/connecting-to-docker-socket-using-client-tls-certs/9469 "2021-01-27T12:57:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevdog](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevdog/32/2825_2.png) [@kevdog](https://community.traefik.io/u/kevdog)\
**Post date:** [January 27, 2021, 12:57pm UTC](https://community.traefik.io/t/connecting-to-docker-socket-using-client-tls-certs/9469/1 "2021-01-27T12:57:59Z")

</div>

Just wondering how to do this:

If I start my docker daemon with the following configuration which exposes the docker deamon over tcp but requires use of tls client certs:

`ExecStart=/usr/bin/dockerd -H unix:///var/run/docker.sock -H tcp://0.0.0.0:2376 --tlsverify --tlscacert=/etc/ssl/self-signed-certs/server/ca.pem --tlscert=/etc/ssl/self-signed-certs/server/cert.pem --tlskey=/etc/ssl/self-signed-certs/server/key.pem`

Can traefik make use of this setup?

For example if including a static traefik.yml file:

```auto
providers:
  docker:
# endpoint: "unix:///var/run/docker.sock"
    endpoint: "tcp://dockerproxy:2376"
    exposedbydefault: false
    watch: true
    network: docker-api

```

Where would you specify the use of client certs? Is this feature even enabled?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [January 27, 2021, 1:30pm UTC](https://community.traefik.io/t/connecting-to-docker-socket-using-client-tls-certs/9469/2 "2021-01-27T13:30:35Z")

</div>

Check out:

> `--providers.docker.tls.ca` :  
> TLS CA
> 
> `--providers.docker.tls.caoptional` :  
> TLS CA.Optional (Default: `false` )
> 
> `--providers.docker.tls.cert` :  
> TLS cert
> 
> `--providers.docker.tls.insecureskipverify` :  
> TLS insecure skip verify (Default: `false` )
> 
> `--providers.docker.tls.key` :  
> TLS key

> **[Traefik CLI Flags Documentation - Traefik](https://doc.traefik.io/traefik/reference/static-configuration/cli/)**
>
> Reference the CLI flags for static configuration in Traefik Proxy. Read the technical documentation.

---

<div class="post-metadata">

**Author:** ![kevdog](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevdog/32/2825_2.png) [@kevdog](https://community.traefik.io/u/kevdog)\
**Post date:** [January 27, 2021, 8:02pm UTC](https://community.traefik.io/t/connecting-to-docker-socket-using-client-tls-certs/9469/3 "2021-01-27T20:02:32Z")

</div>

@cakiwi

Thanks -- that totally worked. Is this a new feature?

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [January 27, 2021, 8:07pm UTC](https://community.traefik.io/t/connecting-to-docker-socket-using-client-tls-certs/9469/4 "2021-01-27T20:07:33Z")

</div>

Looks like it goes back to 2.0

[https://doc.traefik.io/traefik/v2.0/reference/static-configuration/cli/](https://doc.traefik.io/traefik/v2.0/reference/static-configuration/cli/)