MeshGateway TLS configuration for multi-domain certificate support

Multi-Domain TLS Support in MeshGateway

In Traefik Mesh v0.6.x, a single MeshGateway resource is designed to reference a specific TLS secret. It does not natively support a list or array of multiple secrets within a single tls block. To achieve multi-domain support via Server Name Indication (SNI) without deploying multiple gateway instances, you must rely on Traefik's underlying certificate store behavior rather than the MeshGateway resource definition alone.

Implementing SNI with Multiple Certificates

While the MeshGateway YAML typically points to one secret, Traefik's core engine can serve multiple certificates if they are available in its configured store. To implement this, you have two primary paths:

• Combined Certificate Secret: Create a single Kubernetes Secret containing a certificate that includes multiple Subject Alternative Names (SANs) for all required domains. This is the most direct way to satisfy a single-secret reference in a MeshGateway.
• Global Certificate Store: Configure Traefik to use a certificate resolver (such as Let's Encrypt via ACME) or a shared store. When Traefik is configured with a resolver, it manages the certificates dynamically, allowing it to present the correct certificate based on the SNI header of the incoming request, regardless of the specific MeshGateway secret reference.

Dynamic Certificate Rotation

Certificate rotation does not require the recreation of the MeshGateway resource. Traefik monitors the underlying Kubernetes Secrets for changes. When the tls.crt or tls.key within the referenced Secret is updated, Traefik detects the change and reloads the certificate into memory automatically.

Verification Steps

To verify that your configuration is serving the correct certificates for different domains, use curl to inspect the handshake:

# Test Domain A
curl -vI https://domain-a.example.com --resolve domain-a.example.com:443:[GATEWAY_IP]

# Test Domain B
curl -vI https://domain-b.example.com --resolve domain-b.example.com:443:[GATEWAY_IP]

Check the * Server certificate: section of the output to ensure the correct Common Name (CN) is being presented for each request.

Required Diagnostic Detail

To provide a more specific configuration path, please clarify: Are you using a manual Kubernetes Secret for your certificates, or are you utilizing a Traefik Certificate Resolver (e.g., ACME/Let's Encrypt)?