Traefik SSL configuration

Question

So, I'm trying to deploy my docker swarm with traefik into a cluster of digital ocean droplets. I'm using traefik as my reverse proxy and load balancer, so I must get SSL certificate using traefik. The documentation seems simple enough so I don't really understand what's going wrong with my config. I hoped you guys could shed some light on what I'm doing wrong. I'm using wildcard domain to have most of my services running as subdomains of my root domain.So here's my toml:

debug = true
logLevel = "DEBUG"
defaultEntryPoints = ["https","http"]

[entryPoints]
  [entryPoints.http]
    address = ":80"
    [entryPoints.http.redirect]
      entryPoint = "https"
  [entryPoints.https]
    address = ":443"
    [entryPoints.https.tls]

[retry]

[docker]
  endpoint="unix:///var/run/docker.sock"
  exposedByDefault=true
  watch=true
  swarmmode=true
  domain="mouv.com"

[acme]
  email = "leonardo@mouv.com"
  storage = "acme.json"
  entryPoint = "https"
  acmeLogging = true
  # caServer = "https://acme-v02.api.letsencrypt.org/directory"
  caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
  [acme.dnsChallenge]
    provider = "digitalocean"
    delayBeforeCheck = 0
  [[acme.domains]]
    main = "*.mouv.com"
    sans = ["mouv.com"]

And here's my docker-stack.yml

version: '3.6'

services:
  traefik:
    image: traefik:latest
    networks:
      - mouv-net
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./traefik.toml:/traefik.toml
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    command: --api
    environment:
      DO_AUTH_TOKEN: "xxxxxxxxxxxxxxxx"
    deploy:
      placement:
        constraints: [node.role==manager]

  user:
    image: hollarves/users-mouv:latest
    networks:
      - mouv-net
    deploy:
      labels:
      - "traefik.port=8500"
      - "traefik.backend=user"
      - "traefik.docker.network=mouv-stack_mouv-net"
      - "traefik.enable=true"
      - "traefik.protocol=http"
      - "traefik.frontend.entryPoints=https"
      - "traefik.frontend.rule=Host:user.mouv.com"

  balances:
    image: hollarves/balances-mouv:latest
    networks:
      - mouv-net
    deploy:
      labels:
        - "traefik.port=8010"
        - "traefik.backend=balance"
        - "traefik.docker.network=mouv-stack_mouv-net"
        - "traefik.enable=true"
        - "traefik.protocol=http"
        - "traefik.frontend.entryPoints=https"
        - "traefik.frontend.rule=Host:balance.mouv.com"

  # this container is not part of traefik's network.
  firebase:
    image: hollarves/firebase-mouv:latest
    networks:
      - firebase-net

   [ ..... more containers ..... ]

networks:
  mouv-net:
    driver: overlay

    [ .... more networks .... ]

I also saw this error in the logs

mueve-stack_traefik.1.ndgfhj96lymx@node-1    | time="2019-02-19T13:15:46Z" level=debug msg="http2: server: error reading preface from client 10.255.0.2:50668: remote error: tls: unknown certificate authority"

And this:

mueve-stack_traefik.1.igy1ilch6wl1@node-1    | time="2019-02-19T13:22:00Z" level=info msg="legolog: [WARN] [mueve.com] acme: error cleaning up: digitalocean: unknown record ID for '_acme-challenge.mueve.com.' "

When I try to navigate to one of my subdomain services I get

subdomain.mouv.com uses an invalid security certificate. The certificate is not trusted because it is self-signed. The certificate is only valid for 9a11926d7857657613b65578dfebc69f.8066eec25224a58acabd968e285babdf.traefik.default.

In my digital ocean domain configuration I'm pretty much just adding an A record pointing to my manager node's IP and a CNAME record as *.mouv.com

Answer 1

The certificates provided by the Let's Encrypt staging (caServer = "https://acme-staging-v02.api.letsencrypt.org/directory") are not valid certificates, it's normal.

https://letsencrypt.org/docs/staging-environment/

The staging environment intermediate certificate (“Fake LE Intermediate X1”) is issued by a root certificate not present in browser/client trust stores. If you wish to modify a test-only client to trust the staging environment for testing purposes you can do so by adding the “Fake LE Root X1” certificate to your testing trust store. Important: Do not add the staging root or intermediate to a trust store that you use for ordinary browsing or other activities, since they are not audited or held to the same standards as our production roots, and so are not safe to use for anything other than testing.

To have valid certificates you have to use Let's Encrypt production endpoint (caServer = "https://acme-v02.api.letsencrypt.org/directory")