bug: `TLSStore` with Wildcard Certificate and `sniStrict: true` does not work

[georglauterbach]

bug: `TLSStore` with Wildcard Certificate and `sniStrict: true` does not work

[mmatur]

Hi @georglauterbach,

Unfortunately I didn't had the time to look at it before. Just starting to reproduce the issue on my side and Iw will come back to you.

[mmatur]

Hi @geoffgarside,

I gave it a try and I have the same behaviour between Traefik v2.10.7 and Traefik v3.0.1.

• Test 1
  • sniStrict set to true

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: subdomain
spec:
  entryPoints: [ websecure ]
  routes:
    - kind: Rule
      match: Host(`subdomain.mydomain.test`)
      services:
        - name: someservice
          namespace: some-namespace-not-ingress
          port: http
          scheme: http
  tls:
    store:
      name: default
      namespace: ingress

Result: Connection closed

• Test 2
  • sniStrict set to true

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: subdomain
spec:
  entryPoints: [ websecure ]
  routes:
    - kind: Rule
      match: Host(`subdomain.mydomain.test`)
      services:
        - name: someservice
          namespace: some-namespace-not-ingress
          port: http
          scheme: http
  tls:
    secretName: cloudflare-origin-certificate # define a secret name to load the certificate in traefik because the when sniStrict is set to true, traefik will verify certificates loadded but not default certificate.
    store:
      name: default
      namespace: ingress

Result: It works

• Test 3
  • sniStrict set to false

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: subdomain
spec:
  entryPoints: [ websecure ]
  routes:
    - kind: Rule
      match: Host(`subdomain.mydomain.test`)
      services:
        - name: someservice
          namespace: some-namespace-not-ingress
          port: http
          scheme: http
  tls:
    store:
      name: default
      namespace: ingress

Result: It works

---

With sniStrict option set to true, Traefik will check certificates that have been loaded and will not check the default certificate.

Doc reference:

With strict SNI checking enabled, Traefik won't allow connections from clients that do not specify a server_name extension or don't match any of the configured certificates. The default certificate is irrelevant on that matter.

It the same behaviour in v2.10

This behaviour has been introduced in Traefik v1.7 and has never been changed since the merge of the PR.

I unassigned myself to have the issue popping during the next triage and be able to discuss with other maintainers about it.

[georglauterbach]

@mmatur any progress on this one?