Internal Server Error with Traefik HTTPS backend on port 443

Question

With docker, I try to setup a traefik backend using HTTPS port 443, so communication between the traefik container and the app container (apache 2.4) will be encrypted.

I got an Internal Server Error if i activate traefik.protocol=https and traefik.port=443 on my docker container. This issue has been documented here: https://github.com/containous/traefik/issues/2770#issuecomment-374926137

Exactly same setup work great with jwidler/nginx-proxy (reverse proxy available on docker hub) for instance. Certificates on the container (apache 2.4 running inside) are real signed one (i installed them on traefik and on the apache of my container). If i request directly my apache container with https://... all browsers say certificate is valid (green). So the certificates in the container are ok.

The question is simple: Using InsecureSkipVerify = true is not safe. Is there any solution for production to be able to make work a container backend with label traefik.protocol=https and traefik.port=443, by using a certificate issued by a well-know authority (in my case Gandi or Comodo).

Thanks.

Answer 1

I guess you may need to add

InsecureSkipVerify = true

in the main/global section

Please refer to https://docs.traefik.io/configuration/commons/, which says:

InsecureSkipVerify : If set to true invalid SSL certificates are accepted for backends.
Note: This disables detection of man-in-the-middle attacks so should only be used on secure backend networks.

Answer 2

I only managed to expose the Kubernetes Dashboard with setting InsecureSkipVerify = true. Here is how I added it to the traefik deployment file (last line):

spec:
  serviceAccountName: traefik-ingress-controller
  terminationGracePeriodSeconds: 60
  containers:
  - image: traefik
    name: traefik-ingress-lb
    ports:
    - name: https
      containerPort: 443
    args:
    - --api
    - --kubernetes
    - --logLevel=INFO
    - --defaultentrypoints=https
    - --entrypoints=Name:https Address::443 TLS
    - --insecureSkipVerify=true