Search code examples
traefikcacertsopenconnect

Traefik does not use cert file provided for OpenConnect VPN

I have setup traefik in docker and use let's encrypt on the domain example.tld with some

services:
  traefik:
    image: "traefik:2.8.2"
    container_name: "traefik"
    hostname: "traefik"
    restart: always
    command:
      - "--serverstransport.insecureskipverify=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "[email protected]" 
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
      - "--providers.file.filename=/etc/traefik/rules.yml"
      - "--providers.file.watch=true"      
    ports:
      - "443:443"
    - "80:80"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./volumes/traefik/log:/etc/traefik/log"
      - "./volumes/traefik/rules.yml:/etc/traefik/rules.yml"
      - "./volumes/traefik/letsencrypt/:/letsencrypt/"

  whoami:
    image: "traefik/whoami"
    container_name: "simple-service"
    restart: always
    labels:
      - "traefik.enable=true"
      - 'traefik.http.routers.whoami.tls.certresolver=letsencrypt'
      - "traefik.http.routers.whoami.rule=Host(`whoami.example.tld`)"

This all functions, but now I wanted to add a OpenConnect VPN on the same port. So in a file provider:

http:
  routers:
    router-vpn:
      entryPoints:
        - websecure
      rule: Host(`vpn.example.tld`) # (same domain)
      service: service-vpn
      store: default

  services:
    service-vpn:
      loadBalancer:
        servers:
        - url: "https://ocserver:3334"

tls:
  stores:
    default:
      defaultCertificate:
        certFile: /etc/traefik/log/certs/cert.pem
        keyFile: /etc/traefik/log/certs/key.pem
  certificates:
    - certFile: /etc/traefik/log/certs/cert.pem
      keyFile: /etc/traefik/log/certs/key.pem

The cert is copied from the OpenConnect server. The problem is that the OCC (OpenConnect Client) and the OCS (OpenConnect Server) connect over http CONNECT (the OCS receives the request) and use the public shown cert for encryption, but because traefik show's the lets encrypt cert the server can't decrypt the answer of the client and so does fail.

So now my question is how can i (on the same domain) force traefik to use the cert file (no matter if valid) for vpn.example.tld and for the rest of the domains use the LE cert?

Solution

  • Traefik currently only supports SNI based cert matching when the cert is valid and even this implementation is unreliable. I suggest using tls-passthrough as per documentation.