Traefik Mesh Gateway mTLS Without Sidecars Across Clusters
Traefik Mesh uses gateway proxies and automated mTLS to secure multi-cluster service traffic without per-pod sidecars, with routing controlled via TrafficRoute CRDs.
Loading…
ReadMeFeed / Community knowledge
#mtls
Real questions. Useful conversations. Find the people who know your stack.
traefikmesh
kubernetesTLS 'certificate has expired' after credential renewal: does Node.js reload the secureContext automatically?
We run a Node.js HTTPS server (current LTS line, using the built-in tls / https modules) with mutual TLS enabled and rejectUnauthorized: true . Client and server certificates are issued by an internal CA with short validity windows, so renewal happens on a schedule without restarting the process. After a renewal, the new certificate and key files are written
nodejsTraefik Mesh mTLS Certificate Rotation and Secret Synchronization
Traefik Mesh implements a zero-trust architecture by utilizing a central Certificate Authority (CA) to distribute identities to sidecar proxies via Kubernetes secrets. This mechanism ensures that mutual TLS (mTLS) is enforced for all inter-service communication based on SPIFFE-like identity standards. A critical requirement for maintaining mesh security is t
NSURLErrorClientCertificateRejected when only matching client certificate is expired in WebKit
When a TLS server requests a client certificate during mutual authentication, WebKit's NSURLSession presents identities from the Keychain that match the server's trusted CA list. If the only matching certificate has expired, the authentication challenge fails with NSURLErrorClientCertificateRejected (-1205) and no system-provided fallback UI appears to let t
SSL Handshake Failure during Client Certificate Verification in Dovecot
A Dovecot configuration requires mutual TLS (mTLS) to authenticate clients via certificates. While the ssl = yes and ssl_cert directives are configured for the server identity, the system must also validate the incoming client certificates against a trusted root. The current uncertainty involves the behavior of the ssl_ca directive when managing a complex tr
dovecotConsul Connect and Envoy Proxy mTLS Interoperability After Certificate Rotation
Consul Connect and Envoy Proxy mTLS Interoperability After Certificate Rotation Consul Connect automatically manages mTLS certificates through its internal CA, distributing rotated certificates to Envoy sidecars for service-to-service encryption. The certificate rotation process involves Consul generating new leaf certificates and updating the Connect CA bun
consultls.Config GetClientCertificate for Proactive Credential Rotation
Implementing mutual TLS (mTLS) in Go typically involves configuring the tls.Config struct. To maintain least-privilege access and avoid service interruption, credentials must be rotated before they expire. While the GetClientCertificate callback allows for dynamic certificate loading without restarting the application, the crypto/tls package evaluates certif