SSL client authentication on per entrypoint

[jonathanantoine]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you expect to see?

Hello,

I want to be able to configure two different entrypoints:
:65443 with mtls
:65444 without it

I know this is a not currently supported as relying solely on the host but this would allow me to allow TLS on only one port in scenario where I can NOT control the used Host to call my traefik instance.

[nmengin]

Hey @jonathanantoine,

Thanks for reaching out.

This looks like a question rather than a issue. To keep things organized here, we ask that questions go to our community forum.

It's pretty active so you might find your answer already there, or get help from other community members quickly!

[jonathanantoine]

Hello,

This is not a question but a feature request @nmengin :)
This is not supported :)

[nmengin]

Hey @jonathanantoine,

Could you describe your need more accurately then?
Indeed, as of today, you can declare the mTLS strategy on a TLSOption (Kubernetes CRD) and apply it on an EntryPoint.

[jonathanantoine]

@nmengin
When deploying traefik on-premise as the TLS Options are applied by Host there is no way to enforce these scenarios :

1. Different TLS certificates by port : one certificate for a given port (public user-visible one) vs a private one (internal use only) on other port.
2. Different authentication enforcment by port : mTLS required on one port, TLS only on other port.

A workaround is to have multiple instances of Traefik but this is a waste of resources and harder to monitor / watch.

My need : being able to set a TLS option by port.

[jonathanantoine]

Any luck to re open this ticket @nmengin :) ?

[juliens]

I suspect there may be a bug here.
It would be worth checking whether it works correctly when two routers share the same host on different entrypoints, each using different TLSOptions.

I've added the bug/possible label so a maintainer can investigate

[jonathanantoine]

@juliens I think its not possible but I realize this was documented in 2.3 (but no more).

It was stated in (v2.3) like this : https://doc.traefik.io/traefik/v2.3/routing/routers/#options