Add parameter to configure TLS entrypoints with ca-bundle file

[nmengin]

Environment & configuration

Traefik version : 1.1.1

Environment : Docker 1.10.3 with swarm cluster (not swarm mode), Traefik in a container (from custom centos:7 image)

Configuration

• Traefik.toml

traefikLogsFile = "/var/log/traefik/traefik.log"
accessLogsFile = "/var/log/traefik/access.log"
logLevel = "INFO"
defaultEntryPoints = ["http", "https"]
[entryPoints]
   [entryPoints.http]
   address = ":80"
     [entryPoints.http.redirect]
       entryPoint = "https"
  [entryPoints.https]
    address = ":443"
    [entryPoints.https.tls]
      [[entryPoints.https.tls.certificates]]
         CertFile = "/certs/traefik/cert.pem"
         KeyFile = "/certs/traefik/key.pem"
[web]
address = ":8080"

• Command line :

--docker=true --docker.endpoint="tcp://xxxx:3376" --docker.exposedbydefault=false --docker.domain="foo.io" --docker.tls=true --docker.tls.ca=/certs/docker/ca.pem --docker.tls.cert=/certs/docker/cert.pem --docker.tls.key=/certs/docker/key.pem

What would I do?

I would like to use ca-bundle file and certificate file as I currently do with my Apache server.

Apache configuration :

SSLCertificateFile /etc/pki/tls/certs/foo.crt
SSLCertificateKeyFile /etc/pki/tls/private/foo.key
SSLCertificateChainFile /etc/pki/tls/certs/foo.ca-bundle

The SSLCertificateChainFile argument does not exist into Traefik TLS configuration.

Actually Apache concatenate the SSLCertificateChainFile and SSLCertificateFile as we have to do manually for Traefik.

Proposal

I suggest to add a new argument into Traefik TLS entrypoint configuration to allow users to submit CA-bundle file as below.

[[entryPoints.https.tls.certificates]]
         CaBundleFile = "/certs/traefik/ca-bundle.pem"
         CertFile = "/certs/traefik/cert.pem"
         KeyFile = "/certs/traefik/key.pem"

The CertFile and CaBundleFile files may be concatenated before to be processed by the crypto librarie.

[emilevauge]

Ping @dtomcej

[dtomcej]

My opinion is that if a CA bundle is required, it should be appended to the user certificate (as you would for intermediate certificates). I think that having a separate section for CAs would be more confusing, since they would have to be tracked separately, but served with the user certificate.

I think that it is not an unfair expectation for users to concatenate the user, intermediate and CA certs if required into a single PEM.

[nmengin]

I solved the problem with a little script ran when the container is started.
It detects if there is a CA file and cert files and concatenates them.