Hi,
I am trying to proxy a HTTP request to a HTTPS backend that requires mutualTLS (defined within the file provider).
However my client certificate is never presented:
{"status":496,"message":"Client certificate not presented"}
This is what I am trying to achieve:
+---------------+
| API Server A |
HTTPS |---------------|
Mutual TLS | serverA.crt |
+----------------->| serverA.key |
| | |
| | |
| +---------------+
|
+----------+ +----------------------+|tlsA.crt
|Client | | Traefik ++tlsA.key
|----------| HTTP |----------------------|
| |+------------> | |
| | | |
| | | ++
+----------+ +----------------------+|tlsB.crt
|tlsB.key +---------------+
| | API Server B |
| |---------------|
| Mutual TLS | serverB.crt |
+----------------->| serverB.key |
HTTPS | |
| |
+---------------+
I have managed to do this successfully via nginx with a simple proxy_pass configuration:
server {
listen 80;
ssl_protocols TLSv1.2;
location / {
proxy_ssl_certificate /etc/nginx/certs/client.crt;
proxy_ssl_certificate_key /etc/nginx/certs/client.key;
proxy_ssl_trusted_certificate /etc/nginx/certs/ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Proto https;
proxy_redirect off;
proxy_pass https://my-secure-backend.domain.com:8443;
}
}
Here is my file provider:
[[tls.certificates]]
certFile = "/certs/client.crt"
keyFile = "/certs/client.key"
[http]
# Add the router
[http.routers]
[http.routers.proxy]
entryPoints = ["http", "https"]
service = "proxy"
rule = "Host(`my-secure-backend-proxy`)"
# Add the service
[http.services]
[http.services.proxy]
[http.services.proxy.loadBalancer]
passHostHeader = false
[[http.services.proxy.loadBalancer.servers]]
url = "https://my-secure-backend.domain.com:8443/"
scheme = "https"
Am I missing something or is this use case not possible with Traefik 2.2?
Thanks in advance.
