HTTPS backend with Traefik's frontend Certificate

[zoomba]

Hello,

I'm still trying to accomplish what I set out to do, as described in this thread:

Browser -> (https)traefik -> (https)service?

Hi, I'm trying to setup traefik to proxy requests to a ssl enabled server, but I cannot seem to get it to work. The backend server must have ssl enabled. If passthrough: true is set in traefik.yml, then the browser just gets the self signed cert from the backend service, although the desired outcome is that traefik's self signed cert should be presented. Else if passthrough is commented, this is the output from the browser: Network Protocol Error An error occurred during a connection to su…

Unfortunately the issue still persists, traefik can talk to the backend via HTTPS, only with the passthrough option, which leads my browser to get the insecure HTTPS certificate of the backend service, instead of traefik's frontend certificate.

Does anyone know what is the ideal way to solve this problem?

• static: traefik.yml

serversTransport:
  insecureSkipVerify: true

providers:
  file:
    filename: /etc/traefik/config.yml
    watch: true

entryPoints:
  web:
    address: :80
    http:
      redirections:
        entryPoint:
          to: web-secure
          scheme: https
          permanent: true

  web-secure:
    address: :443

• dynamic: config.yml

tls:
  options:
    default:
      sniStrict: true
      minVersion: VersionTLS12
      cipherSuites:
        - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
        - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
        - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/certs/frontend.crt
        keyFile: /etc/traefik/certs/frontend.key
  certificates:
    - certFile: /etc/traefik/certs/frontend.crt
      keyFile: /etc/traefik/certs/frontend.key
      stores:
        - default

tcp:
  routers:
    serviceA-router:
      rule: "HostSNI(`sub.domain.tld`)"
      service: serviceA
      tls:
        passthrough: true
        domains:
          - main: "*.domain.tld" # frontend.crt covers this wildcard

  services:
    serviceA:
      loadBalancer:
        servers:
          - address: hostname:8443