title: How to fix "bad certificate error" in traefik 2.0?
body: <p>I'm setting up traefik 2.0-alpha with Let's Encrypt certificates inside GKE, but now i'm in stupor with "server.go:3012: http: TLS handshake error from 10.32.0.1:2244: remote error: tls: bad certificate" error in container logs.</p>
  
  <p>Connections via http working fine. When i try to connect via https, traefik return 404 with its own default certificates.
  I found same problem for traefik v1 on github. Solution was in adding to config:</p>
  
  <pre><code>InsecureSkipVerify = true
  passHostHeader = true
  </code></pre>
  
  <p>It doesn't help me.</p>
  
  <p>Here is my configmap</p>
  
  <pre><code>apiVersion: v1
  kind: ConfigMap
  metadata:
    name: traefik-ingress-configmap
    namespace: kube-system
  data:
    traefik.toml: |
      [Global]
      sendAnonymousUsage = true
      debug = true
      logLevel = "DEBUG"
  
      [ServersTransport]
        InsecureSkipVerify = true
  
      [entrypoints]
        [entrypoints.web]
            address = ":80"
        [entryPoints.web-secure]
            address = ":443"
        [entrypoints.mongo-port]
            address = ":11111"
  
      [providers]
      [providers.file]
      [tcp] # YAY!
        [tcp.routers]
            [tcp.routers.everything-to-mongo]
              entrypoints = ["mongo-port"]
              rule = "HostSNI(`*`)" # Catches every request
              service = "database"
        [tcp.services]
          [tcp.services.database.LoadBalancer]
            [[tcp.services.database.LoadBalancer.servers]]
              address = "mongodb-service.default.svc:11111"
  
      [http]
        [http.routers]
          [http.routers.for-jupyterx-https]
            entryPoints = ["web-secure"] # won't listen to entrypoint mongo-port
            # rule = "Host(`clients-ui.ddns.net`)"
            # rule = "Path(`/jupyterx`)" # abo /jupyterx/*
            rule = "PathPrefix(`/jupyterx`)"
            service = "jupyterx"
            [http.routers.for-jupyterx.tls]
  
          [http.routers.for-jupyterx-http]
            entryPoints = ["web"] # won't listen to entrypoint mongo-port
            # rule = "Host(`clients-ui.ddns.net`)"
            # rule = "Path(`/jupyterx`)" # abo /jupyterx/*
            rule = "PathPrefix(`/jupyterx`)"
            service = "jupyterx"
  
        [http.services]
          [http.services.jupyterx.LoadBalancer]
          PassHostHeader = true
          # InsecureSkipVerify = true
          [[http.services.jupyterx.LoadBalancer.servers]]
          url = "http://jupyter-service.default.svc/"
          weight = 100
  
      [acme] # every router with TLS enabled will now be able to use ACME for its certificates
        email = "account@mail.com"
        storage = "acme.json"
      #   onHostRule = true # dynamic generation based on the Host() &amp; HostSNI() matchers
        caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
        [acme.httpChallenge]
            entryPoint = "web" # used during the challenge
  
  </code></pre>
  
  <p>And DaemonSet yaml:</p>
  
  <pre><code># ---
  # apiVersion: v1
  # kind: ServiceAccount
  # metadata:
  #   name: traefik-ingress-controller
  #   namespace: kube-system
  ---
  kind: DaemonSet
  apiVersion: extensions/v1beta1
  metadata:
    name: traefik-ingress-controller
    namespace: kube-system
    labels:
      k8s-app: traefik-ingress-lb
  spec:
    template:
      metadata:
        labels:
          k8s-app: traefik-ingress-lb
          name: traefik-ingress-lb
      spec:
        serviceAccountName: traefik-ingress-controller
        terminationGracePeriodSeconds: 60
        volumes:
          # - name: traefik-ui-tls-cert
          #   secret:
          #     secretName: traefik-ui-tls-cert
          - name: traefik-ingress-configmap
            configMap:
              name: traefik-ingress-configmap
        containers:
        - image: traefik:2.0 # The official v2.0 Traefik docker image
          name: traefik-ingress-lb
          ports:
          - name: http
            containerPort: 80
            hostPort: 80
          - name: web-secure
            containerPort: 443
            hostPort: 443
          - name: admin
            containerPort: 8080
          - name: mongodb
            containerPort: 11111
          volumeMounts:
            - mountPath: "/config"
              name: "traefik-ingress-configmap"
          args:
          - --api
          - --configfile=/config/traefik.toml
  ---
  kind: Service
  apiVersion: v1
  metadata:
    name: traefik-ingress-service
    namespace: kube-system
  spec:
    selector:
      k8s-app: traefik-ingress-lb
    ports:
      - protocol: TCP
        port: 80
        name: web
      - protocol: TCP
        port: 443
        name: web-secure
      - protocol: TCP
        port: 8080
        name: admin
      - port: 11111
        protocol: TCP
        name: mongodb
    type: LoadBalancer
    loadBalancerIP: 1.1.1.1
  </code></pre>
  
  <p>Have any suggestions, how to fix it?</p>