# Tls.passthrough with cert possible?

**URL:** <https://community.traefik.io/t/tls-passthrough-with-cert-possible/20328>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [October 31, 2023, 2:58pm UTC](https://community.traefik.io/t/tls-passthrough-with-cert-possible/20328 "2023-10-31T14:58:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JaneM](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@JaneM](https://community.traefik.io/u/JaneM)\
**Post date:** [October 31, 2023, 2:58pm UTC](https://community.traefik.io/t/tls-passthrough-with-cert-possible/20328/1 "2023-10-31T14:58:26Z")

</div>

I am trying to put a well-known security vulnerability scanner behind a traefik proxy and use a TLS certificate from traefik. I would normally use an http.services but found that the application was complaining that I was accessing an HTTPS site over an HTTP connection.

I read that I needed to do a TLS passthrough but that was only possible with a tcp.router. I am now able to connect but it does not seem to be passing the TLS cert from traefik. Does TCP.router support TLS certificates ?

This is what I have been using

```auto
      - "traefik.tcp.routers.nessus.rule=HostSNI(`app.domain`)"
      - "traefik.tcp.routers.nessus.entrypoints=https"
      - "traefik.tcp.routers.nessus.tls=true"
      - "traefik.tcp.routers.nessus.tls.passthrough=true"
      - "traefik.tcp.services.nessus.loadbalancer.server.port=443"

```

All of my other services and hosted sites are able to use http.routers and will pul lets encrypt certs from traefik.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [October 31, 2023, 8:36pm UTC](https://community.traefik.io/t/tls-passthrough-with-cert-possible/20328/2 "2023-10-31T20:36:35Z")

</div>

AFAIK a TLS passthrough is possible with a http and a tcp router. It tells Traefik that it has a TLS cert to decrypt the request to use Host() or HostSNI() and then forward the original encrypted request. This means you need to create a custom cert which Traefik and your target service use, otherwise it doesn’t work.

So this won’t work with LetsEncrypt, unless you manually export the certs from `acme.json` and also use them in your target service, don’t forget regular updates.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [November 5, 2023, 3:39pm UTC](https://community.traefik.io/t/tls-passthrough-with-cert-possible/20328/3 "2023-11-05T15:39:41Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.