Apache2反向代理Docker部署的Traefik时HTTPS证书域名错误怎么解决

故障根本原因 #

你遇到的SSL_ERROR_BAD_CERT_DOMAIN报错发生在浏览器与Apache的TLS握手阶段，请求还未转发到Traefik：

• 你当前的Apache 443端口虚拟主机未配置对应子域名的SSL证书，浏览器握手时拿到的是Apache默认的不匹配域名的证书
• 原有配置错误将HTTPS请求转发到Traefik的HTTP端口（8050），进一步加剧了链路异常

可行解决方案（无需修改Traefik原有逻辑、无需手动维护子域名配置） #

方案一：Apache做TLS终止，自动同步Traefik证书（推荐，兼容Apache现有其他站点配置） #

这个方案的逻辑是Apache负责处理公网的TLS加密，本地和Traefik走明文HTTP传输，证书直接复用Traefik已经自动申请好的内容：

1. 安装依赖工具用于解析Traefik的证书文件：

apt install jq

2. 编写证书导出脚本/usr/local/bin/export-traefik-certs.sh，替换脚本中ACME_FILE为你自己的acme.json实际存储路径：

#!/bin/bash
ACME_FILE="/opt/traefik/acme.json"
CERT_DIR="/etc/apache2/ssl/traefik"
mkdir -p $CERT_DIR

# 遍历导出所有Traefik已申请的证书
for row in $(jq -r '.Certificates[] | @base64' $ACME_FILE); do
  _jq() {
    echo ${row} | base64 -d | jq -r ${1}
  }
  DOMAIN=$(_jq '.domain.main')
  echo $(_jq '.certificate') | base64 -d > "$CERT_DIR/$DOMAIN.crt"
  echo $(_jq '.key') | base64 -d > "$CERT_DIR/$DOMAIN.key"
done

# 重载Apache加载新证书
systemctl reload apache2

3. 给脚本加执行权限并添加定时任务，每小时自动同步一次证书：

chmod +x /usr/local/bin/export-traefik-certs.sh
(crontab -l 2>/dev/null; echo "0 * * * * /usr/local/bin/export-traefik-certs.sh") | crontab -

4. 替换原有Apache 443端口虚拟主机配置：

<VirtualHost *:443>
  ProxyPreserveHost On
  ProxyRequests Off

  ServerName services.example.com
  ServerAlias *.services.example.com

  # 启用TLS，动态匹配对应子域名的证书
  SSLEngine On
  SSLCertificateFile /etc/apache2/ssl/traefik/%{SERVER_NAME}.crt
  SSLCertificateKeyFile /etc/apache2/ssl/traefik/%{SERVER_NAME}.key
  SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
  SSLCipherSuite HIGH:!aNULL:!MD5

  # 本地明文转发到Traefik的HTTP端口
  ProxyPass / http://localhost:8050/
  ProxyPassReverse / http://localhost:8050/

  ErrorLog ${APACHE_LOG_DIR}/services.example.com.error.log
  CustomLog ${APACHE_LOG_DIR}/services.example.com.access.log combined

  <Location />
    Order deny,allow
    Allow from all
  </Location>
</VirtualHost>

5. 启用Apache必要模块后重载配置：

a2enmod ssl proxy proxy_http
systemctl restart apache2

方案二：Apache四层透传TLS流量，证书完全由Traefik处理 #

如果不想在Apache上维护证书，可直接将443端口的*.services.example.com流量透传到Traefik的HTTPS端口，TLS握手直接由浏览器和Traefik完成：

1. 启用Apache必要模块：

a2enmod proxy proxy_tcp ssl proxy_connect

2. 替换原有Apache 443端口虚拟主机配置：

<VirtualHost *:443>
  ServerName services.example.com
  ServerAlias *.services.example.com

  # 透传TLS流量到Traefik的HTTPS端口8051
  SSLProxyEngine On
  SSLProxyVerify none
  SSLProxyCheckPeerCN off
  SSLProxyCheckPeerName off
  SSLProxyCheckPeerExpire off
  ProxyPass / https://localhost:8051/
  ProxyPassReverse / https://localhost:8051/

  ProxyPreserveHost On
  ErrorLog ${APACHE_LOG_DIR}/services.example.com.error.log
  CustomLog ${APACHE_LOG_DIR}/services.example.com.access.log combined
</VirtualHost>

3. 重载Apache配置生效：

systemctl restart apache2

内容的提问来源于stack exchange，提问作者CompuChip