# mTLS between Traefik and Backend service

**URL:** <https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466>\
**Category:** Traefik v2\
**Tags:** docker-swarm\
**Created:** [April 29, 2023, 3:48pm UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466 "2023-04-29T15:48:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![alebeta90](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alebeta90/32/1308_2.png) [@alebeta90](https://community.traefik.io/u/alebeta90)\
**Post date:** [April 29, 2023, 3:48pm UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/1 "2023-04-29T15:48:26Z")

</div>

Hi all,

I had been reading since couple of weeks the topic of mTLS with Traefik. I can find in the internet it is possible to configure Traefik use mTLS from `external client` to `Traefik`. In my case I'm interested in mTLS between Traefik itself and the backend service, so that the communication between Traefik and Backend is "secure".

I was reading this option

> **[Traefik Services Documentation - Traefik](https://doc.traefik.io/traefik/routing/services/#certificates)**
>
> Learn how to configure routing and load balancing in Traefik Proxy to reach Services, which handle incoming requests. Read the technical documentation.

But not sure if it will make the Traefik request to my backend to use mTLS or not. I just need to get a confirmation from someone so that I can start implementing it, or if someone can share its experience would be great.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 29, 2023, 5:15pm UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/2 "2023-04-29T17:15:16Z")

</div>

In general you can define a `serverTransport` with custom certs that you can assign to a Traefik `service` to use it to connect to the target service with TLS.

---

<div class="post-metadata">

**Author:** ![alebeta90](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alebeta90/32/1308_2.png) [@alebeta90](https://community.traefik.io/u/alebeta90)\
**Post date:** [April 29, 2023, 6:27pm UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/3 "2023-04-29T18:27:50Z")

</div>

Hi @bluepuma77

So it means, that the serverTransport should be applied to the Traefik service(container) since it is the one being the client in this case? It should not be declare on the backend service?

thanks

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 30, 2023, 6:40am UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/4 "2023-04-30T06:40:59Z")

</div>

You can apply it globally on `entrypoint` (static config) or assign it to a single Traefik `service` in dynamic config.

---

<div class="post-metadata">

**Author:** ![alebeta90](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alebeta90/32/1308_2.png) [@alebeta90](https://community.traefik.io/u/alebeta90)\
**Post date:** [April 30, 2023, 7:46am UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/5 "2023-04-30T07:46:06Z")

</div>

When we say Traefik service, we mean the Traefik instance service itself or a service served by Traefik meaning this [Traefik Services Documentation - Traefik](https://doc.traefik.io/traefik/routing/services/)?

thanks

---

<div class="post-metadata">

**Author:** ![alebeta90](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/alebeta90/32/1308_2.png) [@alebeta90](https://community.traefik.io/u/alebeta90)\
**Post date:** [April 30, 2023, 11:32am UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/6 "2023-04-30T11:32:59Z")

</div>

Ok, with some testing, manage to understand it. You meant the service configuration in Traefik. Now it is working.

thanks for the help understanding

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [May 3, 2023, 11:33am UTC](https://community.traefik.io/t/mtls-between-traefik-and-backend-service/18466/7 "2023-05-03T11:33:52Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.