Internal Server Error with Traefik HTTPS backend on port 443

Question

With docker, I try to setup a traefik backend using HTTPS port 443, so communication between the traefik container and the app container (apache 2.4) will be encrypted.

I got an Internal Server Error if i activate traefik.protocol=https and traefik.port=443 on my docker container. This issue has been documented here: https://github.com/containous/traefik/issues/2770#issuecomment-374926137

Exactly same setup work great with jwidler/nginx-proxy (reverse proxy available on docker hub) for instance. Certificates on the container (apache 2.4 running inside) are real signed one (i installed them on traefik and on the apache of my container). If i request directly my apache container with https://... all browsers say certificate is valid (green). So the certificates in the container are ok.

The question is simple: Using InsecureSkipVerify = true is not safe. Is there any solution for production to be able to make work a container backend with label traefik.protocol=https and traefik.port=443, by using a certificate issued by a well-know authority (in my case Gandi or Comodo).

Thanks.

score 15 · Answer 1 · answered Apr 27 '18 at 04:38

15

I guess you may need to add

InsecureSkipVerify = true

in the main/global section

Please refer to https://docs.traefik.io/configuration/commons/, which says:

InsecureSkipVerify : If set to true invalid SSL certificates are accepted for backends.
Note: This disables detection of man-in-the-middle attacks so should only be used on secure backend networks.

answered Apr 27 '18 at 04:38

chxzqw

159
1
6

1

Thank you so much :) This had me going for several hours before I came by your solution. – MindTooth Jun 04 '18 at 14:58
1

That's specifically listed as not a good solution in the question. As of the writing of this comment, Traefik does not support SNI for backend connections, so there's no way to use any kind of certificate without an IP SAN for the backend's IP. – Rafael Fonseca Sep 23 '18 at 23:40
1

Any idea what the Traefik v2 equivalent is? – Jans Rautenbach Apr 03 '22 at 13:49
1

@JansRautenbach: https://doc.traefik.io/traefik/routing/overview/#insecureskipverify – Christopher Markieta Mar 28 '23 at 02:36

score 3 · Answer 2 · answered Dec 04 '18 at 14:09

I only managed to expose the Kubernetes Dashboard with setting InsecureSkipVerify = true. Here is how I added it to the traefik deployment file (last line):

spec:
  serviceAccountName: traefik-ingress-controller
  terminationGracePeriodSeconds: 60
  containers:
  - image: traefik
    name: traefik-ingress-lb
    ports:
    - name: https
      containerPort: 443
    args:
    - --api
    - --kubernetes
    - --logLevel=INFO
    - --defaultentrypoints=https
    - --entrypoints=Name:https Address::443 TLS
    - --insecureSkipVerify=true

score 1 · Answer 3 · answered Sep 11 '19 at 16:04

1

The problem for me was traefik.protocol=https; this was not necessary to enable https and directly caused the 500.

answered Sep 11 '19 at 16:04

Californian

808
1
8
15

score 0 · Answer 4 · answered Nov 18 '21 at 12:22

As mentioned earlier:

That's specifically listed as not a good solution in the question. As of the writing of this comment, Traefik does not support SNI for backend connections, so there's no way to use any kind of certificate without an IP SAN for the backend's IP. – Rafael Fonseca Sep 23 '18 at 23:40

https://github.com/traefik/traefik/issues/3906 addresses this problem.

Traefik communicates with the backend internally in a node via IP addresses. For those the used certificate is not valid.

There are two options:

Communicate via http between Traefik and the backend
Use --insecureSkipVerify=true to ignore the certificate validation

The first solution is configured at the ingress:

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: some-ingress
      annotations:
        traefik.ingress.kubernetes.io/router.entrypoints: websecure
    spec:
      rules:
      - http:
          paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: service-name
                port:
                  number: 80
      tls:
      - secretName: traefik-cert

The second solution is to set --serversTransport.insecureSkipVerify=true via arg.

score 0 · Answer 5 · answered Feb 03 '23 at 20:24

0

To enable an Https-Backend-Connection on a certain container, you can use

- "traefik.http.services.service0.loadbalancer.server.scheme=https"

as a label on the Docker container.

Reference on Github

answered Feb 03 '23 at 20:24

os_1

105
5

Internal Server Error with Traefik HTTPS backend on port 443

5 Answers5

Linked