Stuck configuring Traefik to use SmallStep CA

[DeepCoreSystem]

Hi,
I am follwing the tutorial to configure popular ACME clients for Traefik in a Docker container

I need guidance about the following sentence: Most importantly, Traefik will need to trust your root CA certificate.
I have executed the following instruction on the Docker host: sudo step certificate install root_ca.crt

Please give step-by-step instructions how to put the root CA into the Traefik container

[maraino]

I haven't tested, but according to the blogpost you need to set the environment variable LEGO_CA_CERTIFICATES pointing to the path of the step-ca root certificate:

LEGO_CA_CERTIFICATES=$(step path)/certs/root_ca.crt

[tashian]

Hi @DeepCoreSystem,

Unfortunately, installing the CA certificate on the host won't affect the CA trust settings in the container environment. You have a couple options for getting the CA trusted inside the Traefik container. You can mount a volume with the CA certificate in it, and provide the path to the certificate via LEGO_CA_CERTIFICATES when starting Traefik (as @maraino describes), or you can build a new Traefik image that trusts your CA.

Here's a Dockerfile that creates a Traefik image that trusts a step-ca instance. All you have to do is plug in the CA URL and fingerprint, either directly in the Dockerfile or via build arguments:

FROM traefik:latest

# Change these, or supply them via build args:
ARG CA_URL=https://ca.example.com
ARG CA_FINGERPRINT=5d7EXAMPLEFINGERPRINTcacf

ENV CA_URL=${CA_URL} CA_FINGERPRINT=${CA_FINGERPRINT}
RUN apk --no-cache add \
        curl \
        jq \
        openssl \
    ; \
    curl -ks "${CA_URL}/root/${CA_FINGERPRINT}" \
      | jq -re ".ca" \
      | tee /usr/local/share/ca-certificates/root_ca.crt; \
    fingerprint=$(openssl x509 -in /usr/local/share/ca-certificates/root_ca.crt -noout -sha256 -fingerprint \
                    | tr -d ":" \
                    | cut -d "=" -f 2 \
                    | tr "[:upper:]" "[:lower:]"); \
    if [ $fingerprint = ${CA_FINGERPRINT} ]; then \
	  /usr/sbin/update-ca-certificates; \
    else \
      echo >&2; \
      echo >&2 "error: CA cert fingerprint $fingerprint does not match expected value ${CA_FINGERPRINT}"; \
      echo >&2; \
      exit 1; \
    fi; \