# Poor rating on ssl labs **URL:** \ **Category:** Traefik v2\ **Tags:** docker-swarm\ **Created:** [October 16, 2019, 8:46am UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400 "2019-10-16T08:46:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![jhmnieuwenhuis](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jhmnieuwenhuis](https://community.traefik.io/u/jhmnieuwenhuis)\ **Post date:** [October 16, 2019, 8:46am UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/1 "2019-10-16T08:46:47Z")
Hy, i am starting to use traefik 2.0. I got it working but the rating on ssllabs is only B =\> This server does not support Forward Secrecy with the reference browsers. Grade capped to B. =\> This server supports TLS 1.0 and TLS 1.1. Grade will be capped to B from January 2020. Should i add some more configuration params ??? My configuration Traefik compose file ```auto command: #- "--log.level=DEBUG" - "--api.insecure=true" - "--providers.docker=true" - "--providers.docker.exposedbydefault=false" - "--entrypoints.web.address=:80" - "--entrypoints.websecure.address=:443" - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true" - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web" #- "--certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory" - "--certificatesresolvers.myhttpchallenge.acme.email=jhmnieuwenhuis@gmail.com" - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json" ``` Pgadmin4 compose file ```auto labels: - "traefik.enable=true" - "traefik.docker.network=mynetwork" # Set up redirect on insecure port to https 443 (using an arbitrary middleware name of `pgadmin4-redirect`) # `pgadmin4-web` is the router name for http to https redirection - "traefik.http.routers.pgadmin4-web.entrypoints=web" - "traefik.http.routers.pgadmin4-web.rule=Host(`pgadmin4.jhmnieuwenhuis.com`)" - "traefik.http.middlewares.pgadmin4-redirect.redirectscheme.scheme=https" - "traefik.http.middlewares.pgadmin4-redirect.redirectscheme.permanent=true" - "traefik.http.routers.pgadmin4-web.middlewares=pgadmin4-redirect@docker" # Handle secure traffic (requires a separate frontend router for TLS) # `pgadmin4-websecure` is the router name for TLS connections - "traefik.http.routers.pgadmin4-websecure.entrypoints=websecure" - "traefik.http.routers.pgadmin4-websecure.rule=Host(`pgadmin4.jhmnieuwenhuis.com`)" - "traefik.http.routers.pgadmin4-websecure.tls=true" # Define which port to connect to the service on (backend) - "traefik.http.services.pgadmin4-service.loadbalancer.server.port=5050" ``` ---
**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\ **Post date:** [October 16, 2019, 9:02am UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/2 "2019-10-16T09:02:48Z")
Hello, Take a look here: [https://docs.traefik.io/v2.0/https/tls/#tls-options](https://docs.traefik.io/v2.0/https/tls/#tls-options) ---
**Author:** ![jhmnieuwenhuis](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jhmnieuwenhuis](https://community.traefik.io/u/jhmnieuwenhuis)\ **Post date:** [October 16, 2019, 9:34am UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/3 "2019-10-16T09:34:29Z")
Thanks !! But I am not sure what the syntax for the tls options should be in a swarm docker compose file. ---
**Author:** ![bd8392](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/bd8392/32/802_2.png) [@bd8392](https://community.traefik.io/u/bd8392)\ **Post date:** [December 8, 2019, 6:57am UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/4 "2019-12-08T06:57:43Z")
Also would need the syntax of the swarm-compose file... ---
**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\ **Post date:** [December 8, 2019, 12:52pm UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/5 "2019-12-08T12:52:59Z")
> Restriction > > In the above example, we've used the [file provider](https://docs.traefik.io/v2.0/providers/file/) to handle these definitions. It is the only available method to configure the certificates (as well as the options and the stores). However, in [Kubernetes](https://docs.traefik.io/v2.0/providers/kubernetes-crd/), the certificates can and must be provided by [secrets](https://docs.traefik.io/v2.0/routing/providers/kubernetes-crd/#tls). > **[Traefik TLS Documentation - Traefik](https://doc.traefik.io/traefik/v2.0/https/tls/)** > > Learn how to configure the transport layer security (TLS) connection in Traefik Proxy. Read the technical documentation. ---
**Author:** ![bd8392](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/bd8392/32/802_2.png) [@bd8392](https://community.traefik.io/u/bd8392)\ **Post date:** [December 10, 2019, 4:05am UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/6 "2019-12-10T04:05:55Z")
Thanks =) I Managed it with docker config in Swarmpit =) ---
**Author:** ![totti4ever](https://avatars.discourse-cdn.com/v4/letter/t/858c86/32.png) [@totti4ever](https://community.traefik.io/u/totti4ever)\ **Post date:** [January 15, 2020, 5:09pm UTC](https://community.traefik.io/t/poor-rating-on-ssl-labs/2400/7 "2020-01-15T17:09:44Z")
woah! just found the solution myself...: > As `tls.options` is a dynamic configuration, you will have to use the [File Provider](https://docs.traefik.io/v2.0/providers/file/) with the following configuration in your traefik.toml file: I therefore put my tls config into a file dynamically loaded from the directory specified in the traefik.yaml * * * _Original Post:_ Hey there, I am having the same warnings and down ratings as OP, but thought, I had done everything right by having the foloowing in my traefik.yml: ```auto tls: options: default: minVersion: VersionTLS12 sniStrict : true cipherSuites: - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 ``` Nevertheless, I figured out, that I had to set the certresolver manually in my docker labels, too - do I also have to put the tls options there a second time?! WOuld be surprised...my docker-compose.yml looks like this re/ the labels: ```auto labels: - traefik.enable=true - traefik.docker.network=internal - traefik.http.services.nextcloud-http.loadbalancer.server.port=80 - traefik.http.routers.nextcloud-https.rule=Host(`nextcloud.domain.tld`) - traefik.http.routers.nextcloud-https.entrypoints=https - traefik.http.routers.nextcloud-https.service=nextcloud-http - traefik.http.routers.nextcloud-https.tls=true - traefik.http.routers.nextcloud-https.tls.certresolver=le - traefik.http.routers.nextcloud-https.middlewares=headers-security-nc@file,nc-redirect-wellknown ``` What am I missing?!? Thanks a lot in advance 🙂