# Trying to understand Traefik routing and resolve Step CA routing issues **URL:** \ **Category:** Traefik v2\ **Tags:** tracing, letsencrypt-acme, docker\ **Created:** [July 2, 2023, 6:21am UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101 "2023-07-02T06:21:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mikeschinkel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mikeschinkel/32/5151_2.png) [@mikeschinkel](https://community.traefik.io/u/mikeschinkel)\ **Post date:** [July 2, 2023, 6:21am UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101/1 "2023-07-02T06:21:27Z")
I have set up Traefik with [Portainer](https://www.portainer.io/) and [Step CA](https://smallstep.com/docs/step-ca/) on a Debian 11 VM running on VMware ESXi and I have documented most of it [**in this Git repo**](https://github.com/gearboxworks/portainer-stacks)). My goal for this will be to create a repo which can be used to install and configure a VM and/or a bare-metal box using 100% infrastructure-as-code — meaning of course not having to manually do anything — to see it all work. I think I am running into some catch-22 issues with needing SSL before SSL is available, but not completely sure. For example, how can I use SSL to get an SSL cert if I don't yet have SSL? **So I have two (2) main questions.** 1. In terms of Traefik endpoints I am not clear if I should be using `websecure` (`HTTPS`/`SSL`) vs. `web` (`HTTP`), or both, and I have that question for all of 1. the Step CA server, 2. the special cases of Portainer and Traefik, and 3. any other container endpoints I want Step CA to generate a cert for. 2. When using Traefik to route `step-ca.local` to `:9000` if I request `https://step-ca.local/health` in the browser I get `Client sent an HTTP request to an HTTPS server.` and the error message in Traefik log is ` level=debug msg="Request has been aborted [192.168.1.10:53691 - /health]: net/http: abort Handler" middlewareName=traefik-internal-recovery middlewareType=Recovery` which tells me pretty much nothing about how to resolve this or if this is a Traefik issue or a Step CA issue. -Mike ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 2, 2023, 7:45am UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101/2 "2023-07-02T07:45:20Z")
What is StepCA? You want to run your own CA? How do you setup your clients to trust your own CA? Normally you have 3 challenge types with Traefik and LetsEncrypt: - httpChallenge uses http to fetch a file - tlsChallenge uses special TLS, so LE needs to be tightly integrated with Traefik - dnsChallenge is using TXT entries in DNS, needed for wildcards and targets not reachable on the Internet ---
**Author:** ![mikeschinkel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mikeschinkel/32/5151_2.png) [@mikeschinkel](https://community.traefik.io/u/mikeschinkel)\ **Post date:** [July 2, 2023, 8:46am UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101/3 "2023-07-02T08:46:32Z")
Step CA is a self-signed cert authority. I linked its name above but here is the exposed URL: - [`step-ca` server](https://smallstep.com/docs/step-ca/) I have it set up to serve `httpChallenge` and `tlsChallenge` via ACME although I haven’t confirmed that the latter is working: - [portainer-stacks/rootdir/etc/traefik/traefik.yaml at main · gearboxworks/portainer-stacks · GitHub](https://github.com/gearboxworks/portainer-stacks/blob/main/rootdir/etc/traefik/traefik.yaml) - [portainer-stacks/rootdir/etc/step/ca.json at main · gearboxworks/portainer-stacks · GitHub](https://github.com/gearboxworks/portainer-stacks/blob/main/rootdir/etc/step/ca.json) My expertise is Go development, not sysadmin, so I am just doing my best here, and not at all clear how everything should be configured. As for trust, I just add Step CA’s root cert to my keychain. This is all just for usage with an mDNS local link NAT network. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [July 2, 2023, 9:32am UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101/4 "2023-07-02T09:32:19Z")
Why use multiple challenges? The regular LE process is that Traefik will check the routers for `Host()` and `HostSNI()` domains, then create certs for those. No need for multiple challenges. Have you checked the [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt)? An alternative solution is to use regular LetsEncrypt with `dnsChallenge` and use public sub-domains on public DNS with internal private IPs. You can point `mynas.example.com -> 192.168.1.100` and get a cert for it. ---
**Author:** ![mikeschinkel](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/mikeschinkel/32/5151_2.png) [@mikeschinkel](https://community.traefik.io/u/mikeschinkel)\ **Post date:** [July 2, 2023, 4:26pm UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101/5 "2023-07-02T16:26:49Z")
> [@bluepuma77](#): > > Why use multiple challenges? Because I did not understand it fully and thus did not know what was needed. I'll remove the `tlsChallenge`, thank you. > [@](#): > > Have you checked the [simple Traefik example](https://github.com/bluepuma77/traefik-best-practice/tree/main/docker-traefik-dashboard-letsencrypt)? > > An alternative solution is to use regular LetsEncrypt with `dnsChallenge` and use public sub-domains on public DNS with internal private IPs. You can point `mynas.example.com -> 192.168.1.100` and get a cert for it. Yes, there are many examples of how to get Let's Encrypt working. However, I specifically want to setup and use Step CA and explicitly want to use `.local` domains, not public sub-domains. Again, I have it all working, enough for basic needs. What I am trying to do now it learn its fine points that I do not yet understand so I can perfect how it works and keep from breaking it in the future. ---
**Author:** ![morgan-pup](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/morgan-pup/32/11353_2.png) [@morgan-pup](https://community.traefik.io/u/morgan-pup)\ **Post date:** [October 4, 2026, 2:28pm UTC](https://community.traefik.io/t/trying-to-understand-traefik-routing-and-resolve-step-ca-routing-issues/19101/6 "2026-10-04T14:28:44Z")
Hey, I know that this post is already a bit older and stuff but I found a solution on how it works with step-ca and traefik and that should go for portainer then too.  Following you can see the traefik config in the dynamic yml format. I have obscured some stuff of course but it should still give an Idea: ```yaml http:  routers: ca-web: rule: Host(`step-ca.example.com`)  service: ca-web entryPoints: - web  middlewares:  - redirect-to-https  ca-websecure:  rule: Host(`step-ca.example.com`)  service: ca-websecure  entryPoints:  - websecure  tls:  serversTransports:  step-ca-transport:  serverName: "step-ca.example.com"  rootCAs:  - "/example/path/ca.pem"  services:  ca-web:  loadBalancer:  servers:  - url: http://step-ca:9000  ca-websecure:  loadBalancer:  servers:  - url: https://step-ca:9000  serversTransport: step-ca-transport   ``` Now for the actual explanation: - The most important part is the [serversTransports](https://doc.traefik.io/traefik/reference/routing-configuration/http/load-balancing/serverstransport/) . It pretty much says how Traefik handles stuff inbetween itself and the service. - In this case we need to give it the Name that is used in your certificate that you use for the step-ca service and if you use your own root ca (for example step-ca itself) you also need to supply the rootCAs as a pem file - The other important part is that your Service/loadbalancer directs to an https address instead of an http address. - Keep in mind that your container still needs to be in same network as traefik and needs the label following label with your network name : traefik.docker.network =example-network - Also the name used in the servers -\> url part is the service name in your compose, etc. so you might need to change it Following the error messages that you get if you dont have something set. 1. If we configure traefik and step-ca "normally" how you would do it with other services you will get the following on your Application: - "client sent an HTTP request to an HTTPS server" - 400 Error 1. Now we changed our configuration so it uses https in the background. The Label equivalent would be this " traefik.http.services.ca -websecure.loadbalancer.server.scheme=https" But Now following error appears in application Log: - "bad certificate" - 500 or other 5xx error - "certificate is valid for localhost, [step-ca.example.com](http://step-ca.example.com) , not step-ca" 3. Now we changed our configuration to add the serversTransports part and attached it to our https service. Now there will only be an error if you have a certificate not signed by public authority: - "certificate signed by unknown authority"