title: Traefik: problem with overriding some default TLS options
body: <p>I apologize in advance if this issue has already been answered, but I could not find anything about it.</p>
  <p>I use traefik version 2.2.1.</p>
  <p>I have 2 routes <code>safe.example.com</code> and <code>example.com</code> each pointing to a different service: the first one is supposed to require a client certificate while the other does not.</p>
  <p>I also want to use let'encrypt to obtain a certificate valid for both routes: <code>CN: example.com</code>, <code>SAN: example.com, safe.example.com</code>.</p>
  <p>Traefik has two entrypoint: <code>web</code> (http) and <code>websecure</code> (https). The <code>web</code> entrypoint just redirects all the requests to <code>websecure</code>.</p>
  <p>I would expect that the <code>safe</code> route to require a client certificate (<code>safe</code> TLS option) without compromising the certificate resolver (<code>default</code> TLS option): when I set the TLS option field at the router level, from what I read in the documentation <a href="https://docs.traefik.io/v2.2/routing/entrypoints/#tls" rel="nofollow noreferrer">https://docs.traefik.io/v2.2/routing/entrypoints/#tls</a> the default configuration (applied at the entrypoint level) will not be applied at all. Am I right?</p>
  <p>I did not want to mess up my configuration so before trying to apply this I wanted to be extra sure. Thanks in advance.</p>
  <p>Here's my configuration:</p>
  <ul>
  <li>static</li>
  </ul>
  <pre><code>
  [providers]
  
  [providers.file]
  
  directory = &quot;/etc/traefik/dynamic/&quot;
  
  watch = true
  
  [entryPoints]
  
  [entryPoints.web]
  
  address = &quot;:80&quot;
  
  [entryPoints.web.http.redirections]
  
  [entryPoints.web.http.redirections.entryPoint]
  
  to = &quot;websecure&quot;
  
  [entryPoints.websecure]
  
  address = &quot;:443&quot;
  
  [entryPoints.websecure.http.tls]
  
  options = &quot;default&quot;
  
  certResolver = &quot;letsenc&quot;
  
  [[entryPoints.websecure.http.tls.domains]]
  
  main = &quot;example.com&quot;
  
  sans = [&quot;safe.example.com&quot;]
  
  [api]
  
  insecure = false
  
  dashboard = true
  
  debug = false
  
  [certificatesResolvers]
  
  [certificatesResolvers.letsenc]
  
  [certificatesResolvers.letsenc.acme]
  
  email = &quot;admin@example.com&quot;
  
  storage = &quot;/etc/traefik/acme.json&quot;
  
  [certificatesResolvers.letsenc.acme.httpChallenge]
  
  entryPoint = &quot;web&quot;
  
  </code></pre>
  <ul>
  <li>dynamic</li>
  </ul>
  <pre><code>
  [http.routers]
  
  [http.routers.app]
  
  rule = &quot;Host(`example.com`)&quot;
  
  service = &quot;app&quot;
  
  entryPoints = [&quot;websecure&quot;]
  
  [http.routers.safe]
  
  rule = &quot;Host(`safe.example.com`)&quot;
  
  service = &quot;safe&quot;
  
  entryPoints = [&quot;websecure&quot;]
  
  [http.routers.safe.tls]
  
  options = &quot;safe&quot;
  
  [http.services]
  
  [http.services.app.loadBalancer]
  
  [[http.services.app.loadBalancer.servers]]
  
  url = &quot;http://app:3000&quot;
  
  [http.services.safe.loadBalancer]
  
  [[http.services.safe.loadBalancer.servers]]
  
  url = &quot;http://safe:3000&quot;
  
  [tls.options]
  
  [tls.options.default]
  
  minVersion = &quot;VersionTLS12&quot;
  
  sniStrict = true
  
  cipherSuites = [
  
  &quot;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384&quot;,
  
  &quot;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384&quot;,
  
  &quot;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256&quot;,
  
  &quot;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256&quot;,
  
  &quot;TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305&quot;,
  
  &quot;TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305&quot;
  
  ]
  
  [tls.options.safe]
  
  minVersion = &quot;VersionTLS12&quot;
  
  sniStrict = true
  
  cipherSuites = [
  
  &quot;TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384&quot;,
  
  &quot;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384&quot;,
  
  &quot;TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256&quot;,
  
  &quot;TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256&quot;,
  
  &quot;TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305&quot;,
  
  &quot;TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305&quot;
  
  ]
  
  [tls.options.safe.clientAuth]
  
  caFiles = [&quot;/etc/traefik/certs/ca.cert.pem&quot;]
  
  clientAuthType = &quot;RequireAndVerifyClientCert&quot;
  
  
  </code></pre>