Skip to content

InsecureSkipVerify not working in 2.0 (or used wrong?) #5784

@jumpingmushroom

Description

@jumpingmushroom

Do you want to request a feature or report a bug?

Bug

What did you do?

I tried to have traefik ignore the certificate returned by a service

What did you expect to see?

The backend service loading normally and displaying the page.

What did you see instead?

A message stating a bad gateway (502 in the traefik log).

Output of traefik version: (What version of Traefik are you using?)

Version:      2.0.1
Codename:     montdor
Go version:   go1.13.1
Built:        2019-09-26T16:18:03Z
OS/Arch:      linux/amd64

What is your environment & configuration (arguments, toml, provider, platform, ...)?

I have a three node docker swarm cluster, with traefik communicating via socket to the swarm. I've tried to define --serverstransport.insecureskipverify=true as part of the startup procedure for traefik, but it seems this is only used for authentication services, and not as in 1.7 where it was used to skip validation of https backends. The backend works as it should and receives the request, but returns a 502 to traefik stating "received handshake message out of context". Am I missing something here or is it not possible to ignore certificates on backends anymore in 2.0?

I have tried to use a file provider as well for writing a static config to proxy to a non-docker service backend that only runs on https, but the results are the same.

version: '3.5'

services:
  traefik:
    image: traefik:v2.0.1
    command:
      # Set log level and enable API
      - "--log.level=ERROR"
      - "--accesslog=true"
      - "--api.insecure"
      # Define docker provider
      - "--providers.docker=true"
      - "--providers.docker.swarmMode=true"
      - "--providers.docker.network=web_traefik-net"
      - "--providers.docker.watch=true"
      - "--providers.docker.exposedbydefault=false"
      # Define entrypoints
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      # Disable SSL verification on backend
      - "--serverstransport.insecureskipverify=true"
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik-net

networks:
  traefik-net:

If applicable, please paste the log output in DEBUG level (--log.level=DEBUG switch)

(paste your output here)

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions