title: Let's encrypt SSL with traefick on ECS Fargate
body: <p>I've been trying to solve this for days, but without any luck:</p>
  <p><strong>Situation:</strong></p>
  <p>I have a ECS cluster on AWS using Fargate, this cluster contains an instance of Traefick 2.3.4 and other containers. I'm using Traefick as reverse proxy to forward the requests to the other containers.
  Using HTTP everything works fine, so I've decided to add also the secure connection to Traefick. I've tried everything that I could find on the Internet but nothing works, when I try to connect to the specified domain with curl it returns:</p>
  <p><code>curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number</code></p>
  <p>Here there are some test that I've done:</p>
  <p>traefick.yml:</p>
  <pre class="lang-yaml prettyprint-override"><code>log:
    level: DEBUG
  
  api:
    dashboard: true
  
  entryPoints:
    web:
      address: :80
      http:
        redirections:
          entryPoint:
            to: websecure
            scheme: https
    websecure:
      address: &quot;:443&quot;
  
  providers:
    ecs:
      clusters:
        - tools-cluster
      region: eu-west-2
      exposedByDefault: false
  
  certificatesResolvers:
    letsencrypt:
      acme:
        caServer: https://acme-staging-v02.api.letsencrypt.org/directory
        email: #########################
        storage: acme.json
        httpchallenge:
          entrypoint: web
  </code></pre>
  <p>Labels:</p>
  <pre><code>&quot;dockerLabels&quot;: {
          &quot;traefik.enable&quot;: &quot;true&quot;,
          &quot;traefik.http.services.traefik.loadbalancer.server.port&quot;: &quot;8080&quot;,
          &quot;traefik.http.routers.traefik.rule&quot;: &quot;Host(`${host}`)&quot;,
          &quot;traefik.http.routers.traefik.entrypoints&quot;: &quot;websecure&quot;,
          &quot;traefik.http.routers.traefik.tls.certresolver&quot;: &quot;letsencrypt&quot;,
          &quot;traefik.http.routers.traefik.service&quot;: &quot;api@internal&quot;
        }
  </code></pre>
  <p>this version returns this error:</p>
  <pre><code>rror: 400 :: urn:ietf:params:acme:error:connection :: Fetching https://traefik.baaluu.com/.well-known/acme-challenge/td8IdOvJ1_GkigY-jPYaA4YsgeiS5FUiuUS-avbpsuY: Error getting validation data, url
  </code></pre>
  <p>It tries to retrieve that data but it can't because it is redirected to the https and it can't retrieve because https doesn't work, I've tried also without the auto redirect, and it returns a similar error, it can't retrieve that data.</p>
  <p>But following this <a href="https://blog.creekorful.com/2020/01/how-to-expose-traefik-2-dashboard-securely-docker-swarm/" rel="nofollow noreferrer">guide</a> it should work correctly.</p>
  <p>So I've decided to move to the dnsChallenge with this configuration:
  Traefick.yml</p>
  <pre class="lang-yaml prettyprint-override"><code>log:
    level: DEBUG
  
  api:
    dashboard: true
  
  entryPoints:
    web:
      address: :80
    websecure:
      address: &quot;:443&quot;
  
  providers:
    ecs:
      clusters:
        - tools-cluster
      region: eu-west-2
      exposedByDefault: false
  
  certificatesResolvers:
    letsencrypt:
      acme:
        caServer: https://acme-staging-v02.api.letsencrypt.org/directory
        email: ######################
        storage: acme.json
        dnsChallenge:
          provider: route53
          delayBeforeCheck: 3
  </code></pre>
  <p>and same labels as before:</p>
  <pre><code>&quot;dockerLabels&quot;: {
          &quot;traefik.enable&quot;: &quot;true&quot;,
          &quot;traefik.http.services.traefik.loadbalancer.server.port&quot;: &quot;8080&quot;,
          &quot;traefik.http.routers.traefik.rule&quot;: &quot;Host(`${host}`)&quot;,
          &quot;traefik.http.routers.traefik.entrypoints&quot;: &quot;websecure&quot;,
          &quot;traefik.http.routers.traefik.tls.certresolver&quot;: &quot;letsencrypt&quot;,
          &quot;traefik.http.routers.traefik.service&quot;: &quot;api@internal&quot;
        }
  </code></pre>
  <p>Still nothing, and I've this inside the logs:<code>AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/170242259&quot;</code>
  That url contains:</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;type&quot;: &quot;urn:ietf:params:acme:error:malformed&quot;,
    &quot;detail&quot;: &quot;Method not allowed&quot;,
    &quot;status&quot;: 405
  }
  </code></pre>
  <p>The latest test that I did is to remove the staging ca server:</p>
  <pre class="lang-yaml prettyprint-override"><code>log:
    level: DEBUG
  
  api:
    dashboard: true
  
  entryPoints:
    web:
      address: :80
    websecure:
      address: :443
  
  providers:
    ecs:
      clusters:
        - tools-cluster
      region: eu-west-2
      exposedByDefault: false
  
  certificatesResolvers:
    letsencrypt:
      acme:
        email: ###############
        storage: acme.json
        dnsChallenge:
          provider: route53
          delayBeforeCheck: 2
  </code></pre>
  <p>The ssl still doesn't work but I don't see any error message inside the logs: this is the last message that I get about a certificate:</p>
  <pre><code>Try to challenge certificate for domain [traefik.baaluu.com] found in HostSNI rule&quot; providerName=letsencrypt.acme routerName=traefik@ecs rule=&quot;Host(`traefik.baaluu.com`)&quot;
  </code></pre>
  <p>And there is not much more after that:
  <a href="https://i.stack.imgur.com/WF1OP.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/WF1OP.png" alt="enter image description here" /></a>
  (I'm sorry for the picture but I don't find a way to extract that logs from ECS)</p>
  <p>The other containers are still reachable on the http protocol.</p>
  <p>If I try to connect to it using telnet I can reach the service:</p>
  <pre class="lang-sh prettyprint-override"><code>telnet traefik.baaluu.com 443
  Trying 3.8.30.164...
  Connected to traefik-1547500306.eu-west-2.elb.amazonaws.com.
  Escape character is '^]'.
  </code></pre>
  <p>Same goes for the 80</p>
  <p>Looking better inside the logs I've also find this</p>
  <pre><code>retry due to: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/chall-v3/9205340157/1Wh0tQ :: urn:ietf:params:acme:error:badNonce :: JWS has an invalid anti-replay nonce: \&quot;0004cbkFTGjCALFGDYOmhruMl6_F_fRSj33cOMvdpx5Xd2M\&quot;, url: &quot;
  time=&quot;2020-12-10T13:08:21Z&quot; level=debug msg=&quot;legolog: [INFO] retry due to: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/chall-v3/9205340157/1Wh0tQ :: urn:ietf:params:acme:error:badNonce :: JWS has an invalid anti-replay nonce: \&quot;0004cbkFTGjCALFGDYOmhruMl6_F_fRSj33cOMvdpx5Xd2M\&quot;, url: &quot;
  </code></pre>
  <p>that contains this url: <a href="https://acme-v02.api.letsencrypt.org/acme/chall-v3/9205340157/1Wh0tQ" rel="nofollow noreferrer">https://acme-v02.api.letsencrypt.org/acme/chall-v3/9205340157/1Wh0tQ</a></p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;type&quot;: &quot;dns-01&quot;,
    &quot;status&quot;: &quot;valid&quot;,
    &quot;url&quot;: &quot;https://acme-v02.api.letsencrypt.org/acme/chall-v3/9205340157/1Wh0tQ&quot;,
    &quot;token&quot;: &quot;44R4gD4_ZmemiCn5rtkqJyWOcjoj09sEgobUvZLH6yc&quot;,
    &quot;validationRecord&quot;: [
      {
        &quot;hostname&quot;: &quot;traefik.baaluu.com&quot;
      }
    ]
  }
  </code></pre>
  <p>So I suppose that the ssl has been generated correctly but I'm not sure.</p>
  <p>Any idea or suggestion?</p>
  <p>Thanks in advance.</p>
  <p>H2K</p>
  <p><strong>Edit:</strong></p>
  <p>I've removed the ssl from the dashboard and I've put it on another container, now entering inside the dashboard I can see this:
  <a href="https://i.stack.imgur.com/t7caC.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/t7caC.png" alt="enter image description here" /></a></p>
  <p>So I suppose that the ssl is working for that domain, but I still can't connect to it.</p>
  <p><strong>Edit 2:</strong></p>
  <p>with telnet if I connect to that url on the port 443 and I request the page I can see the content:</p>
  <pre><code>telnet xxxxxxxxxxxxxxxxx 443
  Trying 3.10.148.201...
  Connected to traefik-1547500306.eu-west-2.elb.amazonaws.com.
  Escape character is '^]'.
  GET /index.html HTTP/1.1
  Host: xxxxxxxxxxxxxxxxx
  </code></pre>
  <p>And the content of the page appears, so it is not a load balacer problem or routing problem, it seems that I can reach the container using the 443, simply the ssl is not there. It is like to have 2 http port and both are behaving in the same way. The 443 at the moment is like a port 80.</p>