Hi @dhilgarth,
The current documentation is incorrect.
When optional is true, Traefik will accept a connection if:
- no client certificate is present
- a client certificate is present AND is signed by a CA listed in clienCA.files
Some improvements on the matter are currently being worked on: Expand Client Auth Type configuration.