Hey! So I've been trying to setup a localhost Traefik to server Traefik instance. I'm trying to send a HTTP request to a localhost DNS to route to a whoami web server at the server backend to read headers. Both instances are running on Docker images with Docker Compose. Localhost Traefik config i…

Using the deprecated option to have a mTLS between Traefik and a backend is a hack that I don't recommend. The PassTLSClientCert works as expected, it extracts the client cert and pass it to the backend through a specific header and it doesn't applied any TLS connection. :slight_smile:

Hey @jbd thanks for the quick response however, I've tried out V1 with the following settings you mentioned on GitHub but I can't seem to get it working pass the second Traefik instance from the same "Bad Gateway" 502 error. Am I missing something? Keep in mind that the client doesn't supply the ce…

[image] johnnyhuy: Hey @jbd thanks for the quick response however, I've tried out V1 with the following settings you mentioned on GitHub but I can't seem to get it working pass the second Traefik instance from the same "Bad Gateway" 502 error. Am I missing something? Can you provide your conf…

Sure, here's the following: Localhost Docker Compose YAML version: '3' services: traefik: image: traefik:alpine command: --api --docker ports: - "80:80" - "443:443" - "8080:8080" volumes: - /var/run/docker.sock:/var/run/docker.sock - ./traefik.toml:/…

Hi @johnnyhuy , Sorry for the delay, the hack works with the deprecated passTLSCert option: traefik.frontend.passTLSCert=true The passTLSClientCert configuration allows to pass the client certificate to the backend in a specific header. I didn't test your use case for now but I will try to do it…

Aha! Yes it did indeed work on with the deprecated passTLSCert as you mentioned. The entire time I was using passTLSClientCert thinking that the deprecated feature was going to produce the same result. Is this intended? Thanks again, feel free to test it whenever you can :blush:

I'm glad that solves your issue. The passTLSCert option doesn't work as expected that's why she is deprecated and the passTLSClientCert exists. :slight_smile:

Hey @jbd I've swapped out passTLSCert with passTLSClientCert base on Traefik v1.7 Common - Pass TLS Client Cert and I don't seem to be getting the same result. Correct me if I'm wrong, its because it's passed in a specific header? :thinking: [frontends] [frontends.frontend1] backend = "backyar…

Hello again :smiley: I've used PassTLSClientCert to try to pass the cert to the destination Traefik reverse proxy that has mTLS enabled with the optional field set to false. This means the request must require the certificate to pass that reverse proxy. But I'm still getting a "bad certificate" er…

Hi @johnnyhuy , Sadly, there is no way to do this, for now, without this passTLSCert hack. This feature will come in the v2.

Traefik to Traefik mTLS authentication

Traefik Traefik v1

jbd July 15, 2019, 10:26am 2

Hi @johnnyhuy,

The following post should answer your question: mTLS - Add client cert on outbound

Topic		Replies	Views
mTLS - Add client cert on outbound Traefik v2	3	1386	July 3, 2019
Pre-defined client certificate to backend request Traefik v2 rest-api , middleware , cli	13	1161	January 2, 2024
Traefik configuration to allow access to a webapp based on a client certificate attribute or attributes Traefik v2 docker	9	1986	January 18, 2021
mTLS between Traefik and an upstream service (with ServersTransport.Certificates) does not work Traefik v2 kubernetes-crd , kubernetes-ingress	2	1359	December 28, 2021
Can traefik act a a client with mTLS to backend? Traefik v2 file , tcp	6	1342	December 11, 2020

Traefik to Traefik mTLS authentication

Related topics