Enable loading of TLS certs from directory without specifying every one in dynamic config about traefik HOT 4 OPEN

Hello @bluepuma77,

Thank you for the suggestion.

Before moving forward on it, I'd like to have more information on your use case.

When we designed the certificate integration into the File provider, we faced an issue that led us to the configuration we proposed and explained why we haven't provided a more automated mechanism.
I'd like to know how this issue can be solved with your proposal.

With the current solution, each cert is attached to one key to avoid checking every possible pair before validating a certificate. If we set only the directory, we lose this behavior which can lead to an overload each time the directory's content is updated and which allows providing "orphan" certificates.
On top of that, in the file provider, the directories are checked recursively, which can increase the amount of time to check the certificates.

How do you think we can mitigate such a behavior?

from traefik.

I'd like to have more information on your use case.

Use case is simple: I have many domains and sub-domains that go through Traefik. More to come. It would be a lot easier for me to just add the cert files (paid or certbot), than additionally also updating the dynamic config file for each pair.

I agree that the loading is a bit more work than just loading dynamic files, as you have the dependency. I would just load all cert files, then for each cert load the according key file and if both are okay, only then add it to the configuration.

Not sure if this is blocking or can be done in an independent thread. I just read on the community forum for the first time that someone seems to have a blocking issue with TLS (link).

from traefik.

I just played around with ansible and certbot and I get a bunch of files for each domain:

• domain.tld.crt
• domain.tld.issuer.crt
• domain.tld.json
• domain.tld.key

So its probably saver to start by finding all .key files and then check for according .crt.

from traefik.

Hello @bluepuma77,

Thank you for the additional information.
I'll share them with the other maintainers during our next triage.

from traefik.