# Terminating TLS and Re-encrypt **URL:** \ **Category:** Traefik v2\ **Tags:** rancher, docker\ **Created:** [June 10, 2023, 1:55am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917 "2023-06-10T01:55:56Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Albert](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Albert](https://community.traefik.io/u/Albert)\ **Post date:** [June 10, 2023, 1:55am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/1 "2023-06-10T01:55:56Z")
Hi, Is it possible to have traefik to re-encrypt the tls after termination at traefik? I have a working mqtts where the TLS is terminated at traefik but the traffic to the server is not. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [June 10, 2023, 9:01am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/2 "2023-06-10T09:01:05Z")
Yes, you can let Traefik terminate TLS and let it forward with TLS with the same or a different cert. ---
**Author:** ![Albert](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Albert](https://community.traefik.io/u/Albert)\ **Post date:** [June 11, 2023, 12:23am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/3 "2023-06-11T00:23:28Z")
Thanks. How about TCP traffic like mqtt where the port is 8883? An example config would be highly appreciated. Thank you. ---
**Author:** ![Exnadella](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/exnadella/32/6631_2.png) [@Exnadella](https://community.traefik.io/u/Exnadella)\ **Post date:** [June 15, 2023, 12:31pm UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/4 "2023-06-15T12:31:10Z")
How do we configure this when using Traefik Hub api gateways or portals. Is it mandatory to have an ingress to handover the TLS or take a new TLS for ingress? ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [June 16, 2023, 7:14am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/5 "2023-06-16T07:14:43Z")
You probably need to open another post in the corresponding forum here for hub/portal. ---
**Author:** ![Albert](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Albert](https://community.traefik.io/u/Albert)\ **Post date:** [June 16, 2023, 8:03am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/6 "2023-06-16T08:03:49Z")
Is it then possible to re-encrypt TCP traffic (non http)? ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [June 16, 2023, 8:18am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/7 "2023-06-16T08:18:59Z")
Yes, you can use `loadbalancer.servers.url=https://...` in a dynamic config file. If the target has a public TLS cert it simply works, otherwise you need to use `insecureskipverify` (global or on the Traefik service) or import the custom cert chain. ---
**Author:** ![Albert](https://avatars.discourse-cdn.com/v4/letter/a/48db29/32.png) [@Albert](https://community.traefik.io/u/Albert)\ **Post date:** [June 16, 2023, 8:29am UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/8 "2023-06-16T08:29:18Z")
That works if the endpoint is an https. What I am trying to do achieve is have traefik receive a MQTTS (tls enabled mqtt) and then re-encypt with another TLS cert before sending to the target. The first part of decrypting TLS from the mqtts is done nicely by traefik but I have not clue what to do to enable re-encryption. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [June 16, 2023, 2:08pm UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/9 "2023-06-16T14:08:59Z")
The [Traefik TCP service documentation](https://doc.traefik.io/traefik/routing/services/#configuring-tcp-services) seems to completely miss a TLS part towards the target service. If you just want to use Traefik to forward the TLS traffic and the MQTT client can live with a proprietary TLS cert from the MQTT server, then you can just do a plain TCP forward, where Traefik does not need or touch any TLS certs (untested): ```auto # traefik.yml entryPoints: tcp: address: ":5678" providers: file: filename: traefik-dynamic.yml ``` ```auto # traefik-dynamic.yml tcp: routers: tcp-router: rule: "HostSNI(`*`)" entryPoints: - tcp service: tcp-service services: tcp-service: loadBalancer: servers: - address: "1.2.3.4:5678" ``` ---
**Author:** ![tspearconquest](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/tspearconquest/32/4029_2.png) [@tspearconquest](https://community.traefik.io/u/tspearconquest)\ **Post date:** [January 30, 2024, 11:47pm UTC](https://community.traefik.io/t/terminating-tls-and-re-encrypt/18917/10 "2024-01-30T23:47:07Z")
I found what's missing. For terminating TLS and re-encrypt, if you have a public signed cert in your backend service, you have to define a servers transport in Traefik config (map field type in YAML config) which sets a FQDN for the backend service that Traefik will define in the Host header on the requests. This definition can be in any of static config, dynamic config, or Kubernetes CRD. Then you have to update your ingress route `service` (type: object) field to add a new `serversTransport` field (type: string) which points to the named servers transport you defined above, as the one to use for this service. This will allow Traefik to send the host header to the pod with a FQDN that matches one of the subject alternative names on the certificate, and allow Traefik to re-encrypt communications with the back end service.