More granular way to use ACME certs over default cert.

[CyrilPeponnet]

What version of Traefik are you using (traefik version)?

Version: 0247332
Codename: cheddar
Go version: go1.7.5
Built: 2017-02-01_11:13:06PM
OS/Arch: linux/amd64

What is your environment & configuration (arguments, toml...)?

version: "3"
services:
  traefik:
    image: cyrilpeponnet/traefik:latest
    deploy:
      update_config:
        parallelism: 1
        delay: 10s
      mode: global
      placement:
        constraints: [node.role == manager]
    environment:
      - "AWS_ACCESS_KEY_ID=BLA"
      - "AWS_SECRET_ACCESS_KEY=BLABLA"
      - "AWS_REGION=us-west-2"
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    networks:
      - backend
      - consul-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: |-
      -c /dev/null
      --web
      --consul
      --consul.endpoint=consul-cluster:8500
      --consul.watch=true
      --docker
      --docker.swarmmode
      --docker.domain=traefik
      --docker.watch
      --debug

  consul-cluster:
    image: consul:latest
    deploy:
      update_config:
        parallelism: 1
        delay: 10s
      mode: global
      placement:
        constraints: [node.role == manager]
    ports:
      - 8500:8500
    networks:
      - consul-net
    environment:
      - 'CONSUL_BIND_INTERFACE=eth2'
    command: agent -server -datacenter traefik -ui -retry-join=tasks.consul-cluster -retry-join=tasks.consul-cluster -bootstrap-expect=2 -client=0.0.0.0


volumes:
  consul-data:

networks:
  backend:
      driver: overlay
  consul-net:
      driver: overlay

defaultEntryPoints = ["http"]

[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
      CertFile = """-----BEGIN CERTIFICATE-----
MIIF...buw==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIHP...iW3Zt8=
-----END CERTIFICATE-----"""
      KeyFile = """-----BEGIN RSA PRIVATE KEY-----
MII...zob==
-----END RSA PRIVATE KEY-----"""


[consul]
  endpoint = "consul-cluster:8500"

[acme]
email = "myemail@domain.tld"
storage = "traefik/acme/account"
entryPoint = "https"
dnsProvider = "route53"
acmeLogging = true
OnHostRule = true
caServer = "https://acme-staging.api.letsencrypt.org/directory"

What did you do?

Spawned a container like:

  webssl:
    image: nginx
    deploy:
      replicas: 1
      labels:
        - "traefik.frontend.rule=Host:testssl.subdomain.domain.tld"
        - "traefik.domain=subdomain.domain.tld"
        - "traefik.port=80"
        - "traefik.frontend.entryPoints=https"
    networks:
      - traefik_backend

networks:
  traefik_backend:
    external:
      name: proxy_backend

I have a default wildcard self signed cert for https endpoint. If a acme cert is present, it will not be used as #1018 will check if a wildcard is present (but still requested).

What did you expect to see?

ACME cert to be used instead of the default cert.

What did you see instead?

Default cert is used despite of having a proper ACME cert requested.

NOTE: I can understand the opposite also:

• If there is a valid wildcard cert, do not request a ACME cert for it (today even if there is a wildcard cert the ACME request is done and the cert not used).

I would love to able to choose the priority to give to the certs presented.

Something like:

certificatesPriority["default", "acme"]

or even better a way to asks certificates only for certain labels (others will use the default one) and use it like:

[acme]
email = "myemail@domain.tld"
storage = "traefik/acme/account"
entryPoint = "https"
dnsProvider = "route53"
acmeLogging = true
OnFlagOnly = true
caServer = "https://acme-staging.api.letsencrypt.org/directory"

webssl:
    image: nginx
    deploy:
      replicas: 1
      labels:
        - "traefik.frontend.rule=Host:testssl.subdomain.domain.tld"
        - "traefik.port=80"
        - "traefik.acme=true
        - "traefik.frontend.entryPoints=https"

Means the ability to requests ACME certs per "frontend" rules and not entrypoints, plus serve ACME cert if defined instead of default cert (if the flag is set).

What do you think?

[CyrilPeponnet]

@dtomcej I would love to have the choice at some point to request/user ACME certificate even if a wildcard cert is available for that domain.

There is two use cases related to this:

1. I have a valid wildcard cert hence I don't need letsencrypt to provide them for my domain.
2. I have a self signed wildcard cert but I want to fetch/use letsencrypt cert for some of my frontends

[CyrilPeponnet]

As a workaround for now, I could use constraints to route 'acme' aware traffic to a dedicated traefik without wildcard cert in place and let the other one with a reverse constraint to take care of wildcard one.

[nmengin]

Fixed by #1772 in V1.3