Traefik does not use cert file provided for OpenConnect VPN - traefik

Question

I have setup traefik in docker and use let's encrypt on the domain example.tld with some
services:
traefik:
image: "traefik:2.8.2"
container_name: "traefik"
hostname: "traefik"
restart: always
command:
- "--serverstransport.insecureskipverify=true"
- "--providers.docker=true"
- "--providers.docker.exposedbydefault=false"
- "--entrypoints.web.address=:80"
- "--entrypoints.websecure.address=:443"
- "--certificatesresolvers.letsencrypt.acme.email=mail#example.tld"
- "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
- "--providers.file.filename=/etc/traefik/rules.yml"
- "--providers.file.watch=true"
ports:
- "443:443"
- "80:80"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock:ro"
- "./volumes/traefik/log:/etc/traefik/log"
- "./volumes/traefik/rules.yml:/etc/traefik/rules.yml"
- "./volumes/traefik/letsencrypt/:/letsencrypt/"
whoami:
image: "traefik/whoami"
container_name: "simple-service"
restart: always
labels:
- "traefik.enable=true"
- 'traefik.http.routers.whoami.tls.certresolver=letsencrypt'
- "traefik.http.routers.whoami.rule=Host(`whoami.example.tld`)"
This all functions, but now I wanted to add a OpenConnect VPN on the same port.
So in a file provider:
http:
routers:
router-vpn:
entryPoints:
- websecure
rule: Host(`vpn.example.tld`) # (same domain)
service: service-vpn
store: default
services:
service-vpn:
loadBalancer:
servers:
- url: "https://ocserver:3334"
tls:
stores:
default:
defaultCertificate:
certFile: /etc/traefik/log/certs/cert.pem
keyFile: /etc/traefik/log/certs/key.pem
certificates:
- certFile: /etc/traefik/log/certs/cert.pem
keyFile: /etc/traefik/log/certs/key.pem
The cert is copied from the OpenConnect server. The problem is that the OCC (OpenConnect Client) and the OCS (OpenConnect Server) connect over http CONNECT (the OCS receives the request) and use the public shown cert for encryption, but because traefik show's the lets encrypt cert the server can't decrypt the answer of the client and so does fail.
So now my question is how can i (on the same domain) force traefik to use the cert file (no matter if valid) for vpn.example.tld and for the rest of the domains use the LE cert?

Answer 1

Traefik currently only supports SNI based cert matching when the cert is valid and even this implementation is unreliable. I suggest using tls-passthrough as per documentation.