Trying to use alternate certificate with Consul KV

Traefik Traefik v2 (latest)
1

Hi.

We're using Consul Catalog for routing and Consul K/V for doing certs. Our tags in Catalog look like so:

      tags = [
        "mortar-static",
        "traefik.enable=true",
        "traefik.http.routers.mortar-static-http.rule=Host(`mortar-static.service.restoffqdn`)",
        "traefik.http.routers.mortar-static-http.entrypoints=web",
        "traefik.http.routers.mortar-static-http.middlewares=mortar-static-http-redirector",
        "traefik.http.middlewares.mortar-static-http-redirector.redirectscheme.scheme=https",
        "traefik.http.routers.mortar-static-https.rule=Host(`mortar-static.service.restoffqdn`)",
        "traefik.http.routers.mortar-static-https.entrypoints=websecure",
        "traefik.http.routers.mortar-static-https.tls=true",
      ]

And our certs are served via a wildcard signed by our internal CA by default from Consul KV:

kv/traefik/tls/certificates/0/certfile
kv/traefik/tls/certificates/0/keyfile

That all works by default. I am now trying to figure out how to get a second service using a different, external certificate.

I'm kind of lost going through the documentation how I would tell traefik to use a different cert in this case.

2

Hi @eadderley

Just add a new index:

kv/traefik/tls/certificates/1/certfile
kv/traefik/tls/certificates/1/keyfile
kv/traefik/tls/certificates/2/certfile
kv/traefik/tls/certificates/2/keyfile
3

Thanks @cakiwi

I already tried that and it didn't work. Thinking about it, is it because the wildcard is first and so is getting matched before the more specific further down?

4

Looking at the code in certificate_store.go

If there is already a cached certificate that matches it will be selected. Otherwise the matching certificate should be selected over a wildcard.

I haven't verified this myself. A contributor would be able to give a definitve answer.

5

Huh.

After some digging I found the problem - the combined ca-crt wasn't properly formed, so this was user error. Thanks for being 2nd set of eyes, @cakiwi !

6

I also did a test with the file provider, once I added the matching cert it was used in preference over the wildcard certificate.

The file provider was updated with the existing traefik instance, no restart.

7

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.