如何批量上传 SNI 证书到 traefik/consul

Question

我们正在使用下面的 docker stack 文件在 docker swarm 中部署 consul 和 traefik。这会从 Lets Encrypt 生成 SSL 证书并按预期工作。但是，我们已经预购了希望用于某些域的通配符链证书（.crt 和 .key）。我们将如何上传这些以使用而不是让我们加密证书？

version: '3'

services:
  consul-leader:
    container_name: consul-leader
    image: consul
    command: agent -server -client=0.0.0.0 -bootstrap -ui
    volumes:
      - consul-data-leader:/consul/data
    environment:
      - CONSUL_BIND_INTERFACE=eth0
      - 'CONSUL_LOCAL_CONFIG={"leave_on_terminate": true}'
    networks:
      - default
      - front-end
    deploy:
      labels:
        - traefik.frontend.rule=Host:consul.domain.com
        - traefik.port=8500
        - traefik.docker.network=front-end
        # Traefik service that listens to HTTP
        - traefik.redirectorservice.frontend.entryPoints=http
        - traefik.redirectorservice.frontend.redirect.entryPoint=https
        # Traefik service that listens to HTTPS
        - traefik.webservice.frontend.entryPoints=https

  consul-replica:
    container_name: consul-replica
    image: consul
    command: agent -server -client=0.0.0.0 -retry-join="consul-leader"
    volumes:
      - consul-data-replica:/consul/data
    environment:
      - CONSUL_BIND_INTERFACE=eth0
      - 'CONSUL_LOCAL_CONFIG={"leave_on_terminate": true}'
    networks:
      - default
      - front-end
    deploy:
      replicas: 0
      placement:
        preferences:
          - spread: node.id

  traefik:
    container_name: traefik
    image: traefik:v1.7
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.role == manager
        preferences:
          - spread: node.id
      labels:
        - traefik.frontend.rule=Host:traefik.domain.com
        - traefik.port=8080
        - traefik.docker.network=front-end
        # Traefik service that listens to HTTP
        - traefik.redirectorservice.frontend.entryPoints=http
        - traefik.redirectorservice.frontend.redirect.entryPoint=https
        # Traefik service that listens to HTTPS
        - traefik.webservice.frontend.entryPoints=https
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /docker/ssl:/docker/ssl
    command: >
      --docker
      --docker.swarmmode
      --docker.watch
      --docker.exposedbydefault=true
      --entrypoints='Name:http Address::80'
      --entrypoints='Name:https Address::443 TLS'
      --consul
      --consul.watch
      --consul.endpoint="consul-leader:8500"
      --acme
      --acme.email=example@email.com
      --acme.storage="traefik/acme/account"
      --acme.entryPoint=https
      --acme.httpChallenge.entryPoint=http
      --acme.onhostrule=true
      --acme.acmelogging=true
      --logLevel=INFO
      --accessLog
      --api
    networks:
      - default
      - front-end
    depends_on:
      - consul-leader

volumes:
  consul-data-leader:
  consul-data-replica:

networks:
  front-end:
    name: front-end
    driver: overlay

Answer 1

Traefik 可以为每个入口点配置多个证书，即

[entryPoints.http.tls]      
  [[entryPoints.http.tls.certificates]]
    certFile = "path/to/my-lets-encrypt.cert"
    keyFile = "path/to/my-lets-encrypt.key"
  [[entryPoints.http.tls.certificates]]
    certFile = "path/to/my-purchased.cert"
    keyFile = "path/to/my-purchased.key"

服务的决定基于请求的host 标头。这意味着，如果您希望域：my-important-domain.com 与购买的证书一起提供，您必须确保仅为该域颁发该证书作为主题或 SAN。这意味着这些域需要从 ACME traefik 配置中排除。

检查下面的相关docs，其中描述了如何做到这一点

# Domains list.
# Only domains defined here can generate wildcard certificates.
# The certificates for these domains are negotiated at traefik startup only.
#
# [[acme.domains]]
#   main = "local1.com"
#   sans = ["test1.local1.com", "test2.local1.com"]
# [[acme.domains]]
#   main = "local2.com"
# [[acme.domains]]
#   main = "*.local3.com"
#   sans = ["local3.com", "test1.test1.local3.com"]