Feature: http-01 support

[kpcyrd]

I'm trying to deploy traefik behind a reverse proxy that doesn't support tls-sni-01, instead I want to use a challenge that works over http. In the code it appears traefik currently only supports explicitly dns-01 and tls-sni-01. Is this correct? For my setup to work, I need http-01. Sadly I couldn't find anything related in the issue tracker.

What did you do?

Configure traefik to acquire certificates with acme.

What did you expect to see?

Valid certificate from let's encrypt

What did you see instead?

traefik default cert

Output of traefik version:

Version: v1.3.2
Codename: raclette
Go version: go1.8.3
Built: 2017-06-29_04:52:35PM
OS/Arch: linux/amd64

[jmaitrehenry]

I have another use case, I would like to migrate some domain from HAproxy to Traefik, but without using the same certificate.

I would like to try the migration by issuing new LE certificate. With an HTTP challenge, I could easily proxify the http request from haproxy to traefik for validating the challenge. And by modifying my host file, I could test the new confguration.

[eldondev]

@ldez Can you comment on whether this is being worked on?

[dimrozakis]

Letsencrypt has temporarily disabled tls-sni: https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996 which makes supporting web/http challenge even more pressing.

[ldez]

https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996:

Update 1: We have decided to re-enable the TLS-SNI-01 challenge for certain major providers who are known not to have issues while we investigate re-enabling TLS-SNI-01 in general. We’re doing this as a safe way to restore service faster for a large number of sites.

[eldondev]

@ldez so do you have a solution for users who are not "major providers" and don't necessarily have access to DNS ACME methods. I am optimistic, but I am not sure that TLS-SNI-01 will end up being re-enabled in the general case.

[jcassee]

https://community.letsencrypt.org/t/2018-01-11-update-regarding-acme-tls-sni-and-shared-hosting-infrastructure/50188

The ACME TLS-SNI-01 validation method will remain disabled permanently for new accounts by default. Since the same problems apply to TLS-SNI-02, TLS-SNI-02 will remain disabled in our upcoming ACMEv2 API endpoint.
[...]
We will implement renewal-only validation through TLS-SNI-01, based on account credentials. That is, if a given account has previously issued a certificate with Let’s Encrypt for a domain name we will allow that account to revalidate and reissue using TLS-SNI-01 for that domain name for a limited time (to be determined).