Traefik v2 和 Invalid Lets Encrypt 证书答案

【问题标题】：Traefik v2 and Invalid Lets Encrypt CertificateTraefik v2 和 Invalid Lets Encrypt 证书
【发布时间】：2020-01-22 09:11:29
【问题描述】：

从 traefik 1 升级到 2 后，我遇到了 traefik 生成证书的问题。我正在使用 docker 提供程序，并使用标签设置所有内容。

这是证书测试的链接：https://check-your-website.server-daten.de/?q=staging.evopoints.co.za

静态traefik.yml 配置为：

global:
  checkNewVersion: true
  sendAnonymousUsage: false

providers:
  docker:
    exposedByDefault: false
    watch: true

entryPoints:
  web-insecure:
    address: ":80"

  web-secure:
    address: ":443"
    transport:
      lifeCycle:
        requestAcceptGraceTimeout: 42
        graceTimeOut: 42
      respondingTimeouts:
        readTimeout: 42
        writeTimeout: 42
        idleTimeout: 42

certificatesResolvers:
  letsencrypt:
    acme:
      email: <private-email>
      storage: acme.json
      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
      httpChallenge:
        entryPoint: web-insecure

api:
  insecure: true
  dashboard: true
  debug: true

log:
  filePath: /mnt/logs/traefik/traefik.log
  level: DEBUG

accessLog:
  filePath: /mnt/logs/traefik/access.log

这里是来自docker-compose.yml的相关sn-ps：

version: '3'

services:

  webapp:
    image: <private registry>
    restart: always

    volumes:
      ... snipped list of volumes ...

    labels:
      - "traefik.enable=true"
      # Create a bunch of required middlewares
      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.https-redirect.redirectscheme.permanent=true"
      - "traefik.http.middlewares.www-redirect.redirectregex.regex=^https://evopoints.co.za/(.*)"
      # Note: all dollar signs need to be doubled for escaping.
      - "traefik.http.middlewares.www-redirect.redirectregex.replacement=https://staging.evopoints.co.za/$${1}"
      - "traefik.http.middlewares.webapp.headers.customrequestheaders.http-x-forwarded-proto=https"
      - "traefik.http.middlewares.webapp.headers.sslredirect=true"
      - "traefik.http.middlewares.webapp.headers.sslforcehost=true"
      - "traefik.http.middlewares.webapp.headers.sslhost=staging.evopoints.co.za"

      # Insecure Entry
      - "traefik.http.routers.webapp-insecure.entrypoints=web-insecure"
      - "traefik.http.routers.webapp-insecure.rule=Host(`staging.evopoints.co.za`)"
      - "traefik.http.routers.webapp-insecure.middlewares=https-redirect"

      # Secure entry
      - "traefik.http.routers.webapp.entrypoints=web-secure"
      - "traefik.http.routers.webapp.rule=Host(`staging.evopoints.co.za`)"
      - "traefik.http.routers.webapp.tls=true"
      - "traefik.http.routers.webapp.tls.certresolver=letsencrypt"
      - "traefik.http.routers.webapp.middlewares=webapp"

  nginx:
    image: <private_registry>
    restart: always
    volumes:
      ... snipped volumnes ...
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.nginx.loadbalancer.server.port=443"
      - "traefik.http.routers.nginx.tls=true"
      - "traefik.http.routers.nginx.entrypoints=web-secure"
      - "traefik.http.routers.nginx.rule=Host(`staging.evopoints.co.za`) && (PathPrefix(`/static`, `/media`) || Path(`/service-worker.js`))"

  traefik:
    image: traefik:v2.1
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./resources/traefik/traefik.yml:/traefik.yml
      - ./resources/traefik/acme.json:/acme.json
      - ./logs/traefik:/mnt/logs/traefik

【问题讨论】：

caServer: https://acme-staging-v02.api.letsencrypt.org/directory => 您正在使用lets-encrypt的暂存基础设施。这是为了测试您的证书是否可以正确生成，而不会危及您在生产服务上的配额。暂存创建的证书由不属于任何浏览器/根 CA 捆绑包的根 CA 签名，因此在自动化测试工具上显示为无效。见letsencrypt.org/docs/staging-environment
openssl s_client -showcerts -servername staging.evopoints.co.za -connect staging.evopoints.co.za:443 对我来说看起来还不错（用于暂存 Let-encrypt 证书）。
在我开始使用 staging 之前，我似乎遇到了普通证书的问题；但那是在我更改我的撰写文件的一些位之前。我将重新启用正常环境并再次测试。感谢您指出这一点@Zeitounator
谢谢@Zeitounator，它现在可以工作了。我对分段的理解是，它允许您生成更多用于测试等，但不知道它们在技术上仍然无效。我只是认为它们会更快过期或类似的东西。
生产https://acme-v02.api.letsencrypt.org/directory

标签： docker docker-compose ssl-certificate lets-encrypt traefik

【解决方案1】：

解决方案正如 zeitounator 在我帖子的 cmets 中指出的那样。 Letencrypt 暂存环境未正确签署证书，这是预期的，因此看起来无效。暂存环境仅用于测试证书是否确实已生成，仅此而已。

更改为生产证书解析器后，一切都按预期工作。

【讨论】：