Have a running Traefik instance that routes a number of http/https services. Certificates are generated via letsencrypt.
Now I want to route a legacy ldaps connection, which I am able to route via nginx. My setup for that is the folowing:
tcp:
routers:
ldap:
rule: HostSNI(`*`)
entryPoints:
- "ldap"
service: "ldap-service"
ldaps:
rule: HostSNI(`*`)
tls:
insecureSkipVerify: "true"
certResolver: cloudflareResolver
entryPoints:
- "ldaps"
service: "ldaps-service"
services:
ldap-service:
loadBalancer:
servers:
- address: "ldap.dmz.mycom.com:389"
ldaps-service:
loadBalancer:
servers:
- address: "ldap.dmz.mycom.com:636"
Now I have two test cases
LDAP only: ldapsearch -H ldap://myproxy.dmz.mycom.com ...
This makes Traefik to connect to the LDAP server and all requested data are delivered fine. The Traefik log shows:
traefik-1 | time="2024-06-23T19:43:46+02:00" level=debug msg="Handling TCP connection from 172.31.32.105:34018 to ldap.dmz.mycom.com:389"
traefik-1 | time="2024-06-23T19:43:46+02:00" level=debug msg="Dial with lookup to address ldap.dmz.mycom.com:389"
LDAPS: ldapsearch -H ldaps://myproxy.dmz.mycom.com ...
This gives me a ldap_result: Can't contact LDAP server (-1)
. The Traefik logs show
traefik-1 | time="2024-06-23T19:46:28+02:00" level=debug msg="Handling TCP connection from 172.31.32.105:43830 to ldap.dmz.mycom.com:636"
traefik-1 | time="2024-06-23T19:46:28+02:00" level=debug msg="Dial with lookup to address ldap.dmz.mycom.com:636"
traefik-1 | time="2024-06-23T19:46:28+02:00" level=debug msg="Serving default certificate for request: \"\""
traefik-1 | time="2024-06-23T19:46:28+02:00" level=debug msg="Error while handling TCP connection: read tcp 10.200.5.5:34078->172.31.20.11:636: read: connection reset by peer"
So Traefik seems to resolve the right router, it even tries to connect to the LDAP backend but the backend allegedly drops the connection. The same backend works when I point ldapsearch
directly to the backend. The backend has a self signed cert, hence the insecureSkipVerify: "true"
What puzzles me is the message "Serving default certificate for request: \"\""
. I believe that the default cert is correct as I have I defined in the static config file like so:
tls:
stores:
default:
defaultGeneratedCert:
resolver: cloudflareResolver
domain:
main: "web.mycom.com"
sans:
- "*.mycom.com"
- "*.dmz.mycom.com"
So now I am out of ideas of what to do. Any ideas of how I can make LDAPS work would be highly appreciated.