Middleware: certificate signed by unknown authority

Traefik Traefik v3 (latest)
,
1

I have my own CA. The root certificate is installed in my browser.
I have a LXC (VM_RP) with reverse proxy wich serves https://*.my.internal.domain with a valid certificate created by my CA.
I have a second LXC (VM_Auth) with an Authentik. The Authentik is reachable unter http://:9000 and https://auth.my.internal.domain
I have a third LXC (VM_App) with an Traefik.

In the traefik dynamic config:

http:
  middlewares:
    traefikAuth:
      basicAuth:
        usersFile: /etc/traefik/dynamic/htusers

    authentik:
      forwardauth:
        address: https://auth.my.internal.domain/outpost.goauthentik.io/auth/traefik
#        address: http://<VM_Auth_IP>:9000/outpost.goauthentik.io/auth/traefik
        trustForwardHeader: true
        authResponseHeaders:
          - X-authentik-username
          - X-authentik-groups
          - X-authentik-email
          - X-authentik-name
          - X-authentik-uid
          - X-authentik-jwt
          - X-authentik-meta-jwks
          - X-authentik-meta-outpost
          - X-authentik-meta-provider
          - X-authentik-meta-app
          - X-authentik-meta-version

My application is served via VM_RP on https://app.my.internal.domain.

Athentication and app works well if I set the address in the traefik config to http://<VM_Auth_IP>:9000
When I set the address to https://auth.my.internal.domain I get an error:

traefik  | 2025-05-12T23:43:37+02:00 DBG github.com/traefik/traefik/v3/pkg/middlewares/auth/forward.go:195 > Error calling https://auth.my.internal.domain/outpost.goauthentik.io/auth/traefik error="Get \"https://auth.my.internal.domain/outpost.goauthentik.io/auth/traefik\": tls: failed to verify certificate: x509: certificate signed by unknown authority" middlewareName=authentik@file middlewareType=ForwardAuth

I have tried to set rootCAs and clientAuth in tls options but with no success.

Where and how I have to set the root CA for external middleware calls?

2

You can try a global insecureSkipVerify in Traefik static config (doc).

3

Thanks for reply, but unfortunately this does not work.