# TLS passthrough, no SNI

**URL:** <https://community.traefik.io/t/tls-passthrough-no-sni/24113>\
**Category:** Traefik v3 (latest)\
**Tags:** file, docker\
**Created:** [August 22, 2024, 12:00am UTC](https://community.traefik.io/t/tls-passthrough-no-sni/24113 "2024-08-22T00:00:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![exprimo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/exprimo/32/9213_2.png) [@exprimo](https://community.traefik.io/u/exprimo)\
**Post date:** [August 22, 2024, 12:00am UTC](https://community.traefik.io/t/tls-passthrough-no-sni/24113/1 "2024-08-22T00:00:50Z")

</div>

Hi

I'm new to traefik and I hope this is not a dumb question.

I have a client that I can't control. It connects to a service, I want to hide behind traefik via https. It checks for the self signed certificates of that service. It does not support SNI. So I need to passthrough TLS.

I first tried with a TCP router, which would not work because of the not supported SNI. Now I'm trying to use an http router. This is the config

```auto
http:
  routers:
    tc-1-https:
      entrypoints: websecure
      rule: Host(`tc.domain.me`)
      service: tc-1-https-service
  services:
    tc-1-https-service:
      loadbalancer:
        passhostheader: true
        servers:
          - url: https://172.21.0.3:443 # docker container url
        serverstransport: mytransport
  serversTransports:
    mytransport:
      serverName: tc-1-https-service
      insecureSkipVerify: true
      certificates:
        - certFile: /etc/traefik/certs/tc/tc-cert.pem
          keyFile: /etc/traefik/certs/tc/tc-key.pem
      rootCAs:
        - /etc/traefik/certs/tc/ca-root.pem

```

Edit: There are no traefik errors, I can see the router and service in the UI. The service is reachable through https (with a warning of course) but the certs are the default traefik certs.

Is it even possible? Any help is highly appreciated.

Thanks!

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [August 22, 2024, 7:16am UTC](https://community.traefik.io/t/tls-passthrough-no-sni/24113/2 "2024-08-22T07:16:17Z")

</div>

The client and the service already use https?

If no SNI is available, you probably need to use a TCP router with `rule: HostSNI(`*`)` which needs a dedicated IP or port as only a single service can be targeted.

If you don’t enable TLS for this `entrypoint` and `router`, the TLS stream is just forwarded.

If you enable TLS, you need to load the custom cert with `tls` section in dynamic config file and set `tls: true` on `router` and `passthrough: true`, otherwise Traefik will terminate TLS and just forward plain content.

---

<div class="post-metadata">

**Author:** ![exprimo](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/exprimo/32/9213_2.png) [@exprimo](https://community.traefik.io/u/exprimo)\
**Post date:** [August 22, 2024, 7:59am UTC](https://community.traefik.io/t/tls-passthrough-no-sni/24113/3 "2024-08-22T07:59:02Z")

</div>

The service serves on https with custom certificates, the client wants to use that connection and checks the certificates. But the client does not support SNI.

I've tried to use `rule: HostSNI(`tc.domain.me`)` which did not work. Is there a difference in using a domain or a \*? I don't think I can use a dedicated port (no access to the client) and no dedicated IP since the request might come from anywhere or the local network.

Sorry if I don't get teh point.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [August 22, 2024, 9:22pm UTC](https://community.traefik.io/t/tls-passthrough-no-sni/24113/4 "2024-08-22T21:22:14Z")

</div>

Using HostSNI with domain only works when Traefik has read access to the cert, because it will try to match the domain, therefore needs to decrypt.

When using `*`, it will not need a TLS cert, as everything matches.