有没有办法在traefik中导入公司根CA？

Question

我有一个运行着traefik的码头工人集群，并且我希望能够在https（目前位于http）中提供Grafana。

我尝试使用以下traefik撰写配置：

version: "3.6"

services:

  traefik:
    image: traefik
    command:
      - --defaultentrypoints=http,https
      - --docker
      - --docker.swarmMode
      - --docker.exposedByDefault=false
      - --docker.domain=sdb.it
      - --docker.watch
      - --entryPoints=Name:http Address::80
      - --entryPoints=Name:https Address::443 clientCA:/etc/ssl/certs/rootca.crt TLS:/etc/ssl/certs/sonarqube.crt,/etc/ssl/certs/sonarqube.key;/etc/ssl/certs/sdbit-grafana.pem,/etc/ssl/certs/sdbit-grafana.key
      - --rootcas=/etc/ssl/certs/rootca.crt
      - --insecureskipverify
      - --logLevel=DEBUG
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 80:80
      - 443:443
    networks:
      - traefik
    secrets:
      - source: sdbit-sonarqube-docker.sdb.it.crt
        target: /etc/ssl/certs/sonarqube.crt
        mode: 644
      - source: sdbit-sonarqube-docker.sdb.it.key
        target: /etc/ssl/certs/sonarqube.key
        mode: 644
      - source: sdbit-grafana.sdb.it.pem
        target: /etc/ssl/certs/sdbit-grafana.pem
        mode: 644
      - source: sdbit-grafana.sdb.it.key
        target: /etc/ssl/certs/sdbit-grafana.key
        mode: 644
      - source: sdb-root-ca.crt
        target: /etc/ssl/certs/rootca.crt
        mode: 644
    deploy:
      placement:
        constraints:
          - node.role == manager

volumes:
  certificates:
    external: true
networks:
  traefik:
    external: true
secrets:
  sdbit-sonarqube-docker.sdb.it.crt:
    external: true
  sdbit-sonarqube-docker.sdb.it.key:
    external: true
  sdbit-grafana.sdb.it.pem:
    external: true
  sdbit-grafana.sdb.it.key:
    external: true
  sdb-root-ca.crt:
    external: true

和grafana上的这些标签：

  grafana:
    image: maven-repo.sdb.it:18080/grafana/grafana:6.0.1
    user: "104"
    depends_on:
      - prometheus
    ports:
      - 3000:3000
    volumes:
      - grafana_data:/var/lib/grafana
    configs:
      - source: grafana_custom_ldap
        target: /etc/grafana/custom_ldap.toml
    environment:
        .....
    labels:
        traefik.docker.network: traefik
        traefik.enable: "true"
        traefik.frontend.rule: Host:sdbit-grafana.sdb.it
        traefik.frontend.redirect.entryPoint: https
        traefik.domain: sdb.it
        traefik.port: 3000
    networks:
      - back-tier
      - front-tier
      - traefik
    restart: always
    deploy:
      placement:
        constraints:
          - node.role==worker

traefik启动时，它不会在日志中显示任何错误，但是当我尝试将浏览器指向traefik日志中的sdbit-grafana.sdb.it时，我会看到：

time="2019-03-27T14:11:35Z" level=debug msg="http2: server: error reading preface from client 10.255.0.2:45240: remote error: tls: unknown certificate authority",

我要工作的证书是从公司CA提取的，而pem文件包含根证书。

从撰写文件中可以看到，我尝试使用rootcas端点中的clientCA，https以及insecureskipverify端点。

有什么想法吗？