Traefik with self-signed backend - kibana

Question

I have the traefik setup to proxy the kibana backend with self signed certs. Whenever I access the backend, I am getting "Internal error" in the browser and I see the following error message in kibana logs.
{"type":"log","#timestamp":"2018-02-04T03:56:26Z","tags":["connection","client","error"],"pid":1,"level":"error","message":"139782929405760:error:14094412:SSL
routines:ssl3_read_bytes:sslv3 alert bad
certificate:../deps/openssl/openssl/ssl/s3_pkt.c:1493:SSL alert number
42\n139782929405760:error:140940E5:SSL routines:ssl3_read_bytes:ssl
handshake
failure:../deps/openssl/openssl/ssl/s3_pkt.c:1216:\n","error":{"message":"139782929405760:error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad
certificate:../deps/openssl/openssl/ssl/s3_pkt.c:1493:SSL alert number
42\n139782929405760:error:140940E5:SSL routines:ssl3_read_bytes:ssl
handshake
failure:../deps/openssl/openssl/ssl/s3_pkt.c:1216:\n","name":"Error","stack":"Error:
139782929405760:error:14094412:SSL routines:ssl3_read_bytes:sslv3
alert bad certificate:../deps/openssl/openssl/ssl/s3_pkt.c:1493:SSL
alert number 42\n139782929405760:error:140940E5:SSL
routines:ssl3_read_bytes:ssl handshake
failure:../deps/openssl/openssl/ssl/s3_pkt.c:1216:\n\n at Error
(native)"}}
Here is my docker-compose file:
---
version: '3.0'
services:
traefik:
image: traefik:1.5-alpine
command: --web --accesslog --docker --docker.watch --docker.domain=localhost --logLevel=ERROR --entryPoints="Name:http Address::80"
ports:
- "80:80"
- "8080"
labels:
- "traefik.frontend.rule=Host:monitor.localhost"
- "traefik.port=8080"
- "traefik.frontend.entryPoints=http"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /dev/null:/traefik.toml
elasticsearch:
image: docker.elastic.co/elasticsearch/elasticsearch-platinum:6.1.3
container_name: elasticsearch
ports:
- "9200"
labels:
- "traefik.frontend.rule=Host:es.localhost"
- "traefik.frontend.entryPoints=http"
environment:
- cluster.name=docker-cluster
- bootstrap.memory_lock=true
- "ES_JAVA_OPTS=-Xms1024m -Xmx1024m"
- ELASTIC_PASSWORD=changeme
cap_add:
- IPC_LOCK
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536
hard: 65536
kibana:
image: docker.elastic.co/kibana/kibana:6.1.3
container_name: kibana
ports:
- "5601"
labels:
- "traefik.frontend.rule=Host:kb.localhost"
- "traefik.frontend.entryPoints=http"
- "traefik.protocol=https"
links:
- elasticsearch
environment:
- SERVER_SSL_ENABLED="true"
- SERVER_SSL_CERT=/usr/share/kibana/config/kibana.example.org.crt
- SERVER_SSL_KEY=/usr/share/kibana/config/kibana.example.org.key
depends_on:
- elasticsearch
How can I make traefik to work with self-signed certs? Am I missing anything in the setup?

Answer 1

I've been dealing with this sort of issue myself. Traefik does not currently support per-backend configuration of TLS parameters, unless it's for client authentication pass-through. The only customization currently offered for reverse-proxy routing in a back-end is with the global insecureSkipVerify boolean setting (See the short blurb for this in Traefik's Commons documentation).
I haven't verified this, but I believe --insecureSkipVerify=true would be the correct flag to pass in your command stanza for Traefik to enable this functionality.
Please note that this will affect all backend connections, and can open you up to man-in-the-middle attacks. Issue #3038 on Traefik's GitHub repository tracks a design idea that would make this configurable per back-end. Feel free to upvote or issue a PR for this feature.