Support for CRL (Certificate Revocation List) validation in mTLS on IngressRoute

Traefik Traefik v3 (latest)
1

Hi Traefik team,

We're currently using Traefik(v2 and v3) as an Ingress Controller in a secure IoT environment where mTLS is enforced using certificates issued by HashiCorp Vault PKI.

Our setup involves:

  • Traefik IngressRoute with tls.clientAuth configured
  • Client certificates provisioned by Vault
  • Regular certificate revocation via CRL (Certificate Revocation List)

We’ve noticed that Traefik does not currently support checking CRLs, which means revoked client certificates can still authenticate unless we rotate them manually. This is a security concern for long-lived or compromised certificates.

Questions:

  1. Is there a way to configure Traefik to enforce CRL checks?
  2. If not, are there any plans to support loading and verifying CRLs in future releases?

Use case: We need to ensure revoked client certificates are rejected at the ingress layer (preferably without replacing Traefik with NGINX).

Would love to hear if there's a workaround.

2

You could open a feature request with the devs at Traefik Github.