Traefik docker creates self-signed ssl certificates. How to disable?

Question

Digital certificates

I'm not sure that I correctly formulated the essence of the question, but it seems to me that this can solve my problem. If there is another solution, please tell me.

It is necessary to redirect all site traffic through the Traefik v2 reverse proxy on two ports 80 and 443, respectively.
It is important in this task to do without redirecting all traffic to https, without self-signed certificates, without certificatesresolvers and without letsencrypt! In other words, we need a simple proxying of requests to the container 80-> 80, 443-> 443

That is, we create two entrypoints in the traffic container: web and websecure

image: traefik:v2.4
    command: 
      - "--api.insecure=true" 
      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false" 
      - "--providers.docker.network=proxy-network"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"

In the container with the site, we indicate in the labels the entry points web and websecure

image: httpd:latest
   labels:
      - "traefik.enable=true"

      - "traefik.http.routers.exampleforhttp.rule=Host(`example.com`)"
      - "traefik.http.routers.exampleforhttp.entrypoints=web"
     
      - "traefik.http.routers.exampleforhttps.rule=Host(`example.com`)"
      - "traefik.http.routers.exampleforhttps.entrypoints=websecure"
      - "traefik.http.routers.exampleforhttps.tls=true"

With this setting, the problem is almost solved,
the site opens via two links
example.com
https://example.com

, the only problem is that when this label is included - "traefik.http.routers.exampleforhttps.tls=true" traefik creates a self-signed certificate and opens the site using the link https://example.com already with its own certificate.

It is necessary that the traffic simply reaches the final container with the apache web server, and then apache itself will fasten the real ssl certificate known to it, stored in the container. Does anyone know how to implement this?

Thank you!

Answer 1

To do this, the port must be forwarded as tcp, not http/https.
But in general this is a bad practice. Just on proxies / balancers, they hang a certificate in such cases, and then terminate traffic to http or https with any certificate.