Multiple overlapping certificates

Traefik Traefik v3 (latest)
1

I have two overlapping certificates.

  • *.domain.com from an external CA
  • *.intranet.domain.com and *.domain.com explicit distributed by an internal CA

Traefik routes into both domains. Now I like to get access to server1.domain.com only using the certificate by the external CA. Both certificates are in the traefik-dynamic.toml:

[[tls.certificates]]
  certFile = "/certs/intranet.domain.com.crt"
  keyFile = "/certs/intranet.domain.com.key"

[[tls.certificates]]
  certFile = "/certs/domain.com.crt"
  keyFile = "/certs/domain.com.key"

I found out that I can use this sequence with the external CA for *.domain.com at second position. Then it works fine and the right external certificate is used. If I change the sequence then the internal is used.

Is this the right way to to get the desired assignment? Is this update save? Are certificate stores the better / foreseen way and how they must be used? The documentation about cerificate and stores https://doc.traefik.io/traefik/https/tls gives not really a help for an assignment of certificate to routers or store to routers.