Prepare release v1.7.8

Fixes docker swarm mode refresh second for KV.
Check for dynamic tls updates on configuration preload
2025-09-08 13:44:22 +03:00 · 2019-01-29 17:22:07 +01:00 · 2019-01-29 17:08:08 +01:00 · 2019-01-29 16:46:09 +01:00 · 2019-01-25 10:24:04 +01:00 · 2019-01-21 17:00:07 +01:00
333 changed files with 21515 additions and 10210 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,93 @@
 # Change Log

+## [v1.7.8](https://github.com/containous/traefik/tree/v1.7.8) (2019-01-29)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.7...v1.7.8)
+
+**Bug fixes:**
+- **[acme]** Updates lego. ([#4428](https://github.com/containous/traefik/pull/4428) by [ldez](https://github.com/ldez))
+- **[acme]** Updates lego. ([#4376](https://github.com/containous/traefik/pull/4376) by [ldez](https://github.com/ldez))
+- **[docker]** Fixes docker swarm mode refresh second for KV. ([#4420](https://github.com/containous/traefik/pull/4420) by [ldez](https://github.com/ldez))
+- **[ecs]** Generic awsvpc support, not just Fargate ([#4360](https://github.com/containous/traefik/pull/4360) by [maartenvanderhoef](https://github.com/maartenvanderhoef))
+- **[ecs]** Cache exising task definitions to avoid rate limiting ([#4177](https://github.com/containous/traefik/pull/4177) by [hwhelan-CB](https://github.com/hwhelan-CB))
+- **[tls]** Check for dynamic tls updates on configuration preload ([#4022](https://github.com/containous/traefik/pull/4022) by [ffilippopoulos](https://github.com/ffilippopoulos))
+- **[tracing]** Support Datadog tracer priority sampling ([#4359](https://github.com/containous/traefik/pull/4359) by [jcassee](https://github.com/jcassee))
+
+**Documentation:**
+- **[acme]** More detailed info about Google Cloud DNS. ([#4395](https://github.com/containous/traefik/pull/4395) by [ldez](https://github.com/ldez))
+- **[acme]** Tested wildcard ACME challenge with DNSimple ([#4384](https://github.com/containous/traefik/pull/4384) by [tstackhouse](https://github.com/tstackhouse))
+- **[docker]** Note about quotes for entrypoint definition with docker-compose ([#4390](https://github.com/containous/traefik/pull/4390) by [Dragnucs](https://github.com/Dragnucs))
+- **[k8s]** Allow Træfik to update Ingress status ([#4397](https://github.com/containous/traefik/pull/4397) by [rbq](https://github.com/rbq))
+- **[k8s]** Minor formatting fixes ([#4394](https://github.com/containous/traefik/pull/4394) by [dbirks](https://github.com/dbirks))
+- **[metrics]** Missing information about statistics parameter ([#4393](https://github.com/containous/traefik/pull/4393) by [decima](https://github.com/decima))
+- **[rules]** Route priorities: document minimum priority value ([#4374](https://github.com/containous/traefik/pull/4374) by [tw-360vier](https://github.com/tw-360vier))
+- Removed repeated entryPoints.http from grpc.md ([#4370](https://github.com/containous/traefik/pull/4370) by [ishaanbahal](https://github.com/ishaanbahal))
+- Happy 2019 ([#4367](https://github.com/containous/traefik/pull/4367) by [emilevauge](https://github.com/emilevauge))
+
+**Misc:**
+- Assert that test timeout service is ready. ([#4398](https://github.com/containous/traefik/pull/4398) by [timoreimann](https://github.com/timoreimann))
+
+## [v1.7.7](https://github.com/containous/traefik/tree/v1.7.7) (2019-01-08)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.6...v1.7.7)
+
+**Bug fixes:**
+- **[acme]** Update Lego ([#4277](https://github.com/containous/traefik/pull/4277) by [ldez](https://github.com/ldez))
+- **[k8s]** Check for watched namespace before getting kubernetes objects ([#4327](https://github.com/containous/traefik/pull/4327) by [dtomcej](https://github.com/dtomcej))
+- **[k8s]** Allow empty path with App-root annotation ([#4326](https://github.com/containous/traefik/pull/4326) by [dtomcej](https://github.com/dtomcej))
+- **[k8s]** kubernetes: sort and uniq TLS secrets ([#4307](https://github.com/containous/traefik/pull/4307) by [zarqman](https://github.com/zarqman))
+- **[k8s]** Skip TLS section with no secret in Kubernetes ingress ([#4340](https://github.com/containous/traefik/pull/4340) by [dtomcej](https://github.com/dtomcej))
+- **[middleware,consul,consulcatalog,docker,ecs,k8s,marathon,mesos,rancher]** Add Pass TLS Cert Issuer and Domain Component ([#4298](https://github.com/containous/traefik/pull/4298) by [jbdoumenjou](https://github.com/jbdoumenjou))
+- **[middleware]** Retry middleware : store headers per attempts and propagate them when responding. ([#4299](https://github.com/containous/traefik/pull/4299) by [jlevesy](https://github.com/jlevesy))
+- **[middleware]** Redirection status codes for methods different than GET ([#4116](https://github.com/containous/traefik/pull/4116) by [r--w](https://github.com/r--w))
+- Test and exit for jq error before domain loop ([#4347](https://github.com/containous/traefik/pull/4347) by [muhlemmer](https://github.com/muhlemmer))
+
+**Documentation:**
+- **[acme]** Letsencrypt - Add info on httpreq format ([#4355](https://github.com/containous/traefik/pull/4355) by [goetas](https://github.com/goetas))
+- **[docker]** Update broken link for Docker service constraints ([#4289](https://github.com/containous/traefik/pull/4289) by [clrech](https://github.com/clrech))
+- **[middleware]** Add extractorfunc values ([#4351](https://github.com/containous/traefik/pull/4351) by [hsmade](https://github.com/hsmade))
+- **[provider]** Rephrase the `traefik.backend` definition in documentation ([#4317](https://github.com/containous/traefik/pull/4317) by [dduportal](https://github.com/dduportal))
+- Harden Traefik systemd service ([#4302](https://github.com/containous/traefik/pull/4302) by [jacksgt](https://github.com/jacksgt))
+
+## [v1.7.6](https://github.com/containous/traefik/tree/v1.7.6) (2018-12-07)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.5...v1.7.6)
+
+**Bug fixes:**
+- **[consulcatalog]** Fix label segmentation when using custom prefix ([#4272](https://github.com/containous/traefik/pull/4272) by [hsmade](https://github.com/hsmade))
+- Update to Go 1.11.3 [CVE-2018-16875](https://nvd.nist.gov/vuln/detail/CVE-2018-16875)
+
+## [v1.7.5](https://github.com/containous/traefik/tree/v1.7.5) (2018-12-03)
+[All Commits](https://github.com/containous/traefik/compare/v1.7.4...v1.7.5)
+
+**Enhancements:**
+- **[docker]** [docker backend] - Add config flag to set refreshSeconds for swarmmode ticker ([#4105](https://github.com/containous/traefik/pull/4105) by [WTFKr0](https://github.com/WTFKr0))
+- **[k8s]** Support canary weight for external name service ([#4135](https://github.com/containous/traefik/pull/4135) by [yue9944882](https://github.com/yue9944882))
+
+**Bug fixes:**
+- **[acme]** Fix ACME spec and Cloudflare. ([#4201](https://github.com/containous/traefik/pull/4201) by [ldez](https://github.com/ldez))
+- **[authentication,middleware]** Remove X-Forwarded-Uri and X-Forwarded-Method from untrusted IP ([#4036](https://github.com/containous/traefik/pull/4036) by [stffabi](https://github.com/stffabi))
+- **[authentication,middleware]** Allow usersFile comments ([#4159](https://github.com/containous/traefik/pull/4159) by [thde](https://github.com/thde))
+- **[authentication]** Fix partial declaration of authentication. ([#4212](https://github.com/containous/traefik/pull/4212) by [ldez](https://github.com/ldez))
+- **[docker]** Verify ctx when we send configuration message in docker provider ([#4185](https://github.com/containous/traefik/pull/4185) by [juliens](https://github.com/juliens))
+- **[ecs]** Filter ECS tasks by LastStatus before adding to list of service tasks ([#4255](https://github.com/containous/traefik/pull/4255) by [hwhelan-CB](https://github.com/hwhelan-CB))
+- **[healthcheck]** Query params in health check ([#4188](https://github.com/containous/traefik/pull/4188) by [mmatur](https://github.com/mmatur))
+- **[metrics]** Upgraded DD APM library ([#4189](https://github.com/containous/traefik/pull/4189) by [aantono](https://github.com/aantono))
+- **[middleware]** Fix ssl force host secure middleware ([#4138](https://github.com/containous/traefik/pull/4138) by [mmatur](https://github.com/mmatur))
+- **[oxy]** Fix unannonced trailers problem when body is empty ([#4258](https://github.com/containous/traefik/pull/4258) by [juliens](https://github.com/juliens))
+- **[provider,server]** Log configuration errors from providers and keeps listening ([#4230](https://github.com/containous/traefik/pull/4230) by [geraldcroes](https://github.com/geraldcroes))
+- **[tls]** Implement Case-insensitive SNI matching ([#4132](https://github.com/containous/traefik/pull/4132) by [dtomcej](https://github.com/dtomcej))
+- Use ParseInt instead of Atoi for parsing durations ([#4263](https://github.com/containous/traefik/pull/4263) by [mmatur](https://github.com/mmatur))
+
+**Documentation:**
+- **[acme]** ACME DNS provider is called `acme-dns` ([#4166](https://github.com/containous/traefik/pull/4166) by [robsdedude](https://github.com/robsdedude))
+- **[docker]** Add a &#34;Security Consideration&#34; section in the Docker&#39;s backend section of the documentation ([#4225](https://github.com/containous/traefik/pull/4225) by [dduportal](https://github.com/dduportal))
+- **[docker]** Clarify swarm loadbalancer documentation ([#4194](https://github.com/containous/traefik/pull/4194) by [jlevesy](https://github.com/jlevesy))
+- **[docker]** Fix spelling in comment ([#4169](https://github.com/containous/traefik/pull/4169) by [giocomai](https://github.com/giocomai))
+- **[docker]** Update swarm mode endpoint ([#4208](https://github.com/containous/traefik/pull/4208) by [siyu6974](https://github.com/siyu6974))
+- **[k8s]** Include an explicit list of kubernetes protocol annotations in docs. ([#4170](https://github.com/containous/traefik/pull/4170) by [shanna](https://github.com/shanna))
+- **[k8s]** Improve kubernetes TLS user guide ([#4175](https://github.com/containous/traefik/pull/4175) by [mterring](https://github.com/mterring))
+- **[k8s]** frame-deny should be set to true to enable the header ([#4171](https://github.com/containous/traefik/pull/4171) by [swestcott](https://github.com/swestcott))
+- **[rules]** Matcher associativity rule. ([#4244](https://github.com/containous/traefik/pull/4244) by [ldez](https://github.com/ldez))
+- Documentation: Rename &#34;admin panel&#34; to &#34;dashboard ([#4156](https://github.com/containous/traefik/pull/4156) by [thernstig](https://github.com/thernstig))
+
 ## [v1.7.4](https://github.com/containous/traefik/tree/v1.7.4) (2018-10-30)
 [All Commits](https://github.com/containous/traefik/compare/v1.7.3...v1.7.4)

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -87,7 +87,7 @@ If you happen to update the provider templates (in `/templates`), you need to ru

 [dep](https://github.com/golang/dep) is not required for building; however, it is necessary to modify dependencies (i.e., add, update, or remove third-party packages)

-You need to use [dep](https://github.com/golang/dep) >= O.4.1.
+You need to use [dep](https://github.com/golang/dep) >= 0.4.1 and < 0.5.0.

 If you want to add a dependency, use `dep ensure -add` to have [dep](https://github.com/golang/dep) put it into the vendor folder and update the dep manifest/lock files (`Gopkg.toml` and `Gopkg.lock`, respectively).

@@ -236,6 +236,14 @@ $ make docs-clean docs-verify
 ...
 ```

+Please note that verification can be disabled by setting the environment variable `DOCS_VERIFY_SKIP` to `true`:
+
+```shell
+DOCS_VERIFY_SKIP=true make docs-verify
+...
+DOCS_LINT_SKIP is true: no linting done.
+```
+
 ## How to Write a Good Issue

 Please keep in mind that the GitHub issue tracker is not intended as a general support forum, but for reporting bugs and feature requests.
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -284,8 +284,8 @@
    ".",
    "parse"
  ]
-  revision = "aad81c7ac7f49671a59b9ede8ab22436e132a302"
-  version = "v1.3.0"
+  revision = "c93d194b807ef171c43344d60adad8b58217390a"
+  version = "v1.4.1"

 [[projects]]
  branch = "master"
@@ -365,16 +365,16 @@
  version = "v3.2.0"

 [[projects]]
+  branch = "master"
  name = "github.com/dimchansky/utfbom"
  packages = ["."]
-  revision = "5448fe645cb1964ba70ac8f9f2ffe975e61a536c"
-  version = "v1.0.0"
+  revision = "d2133a1ce379ef6fa992b0514a77146c60db9d1c"

 [[projects]]
-  branch = "master"
  name = "github.com/dnsimple/dnsimple-go"
  packages = ["dnsimple"]
-  revision = "bbe1a2c87affea187478e24d3aea3cac25f870b3"
+  revision = "f5ead9c20763fd925dea1362f2af5d671ed2a459"
+  version = "v0.21.0"

 [[projects]]
  name = "github.com/docker/cli"
@@ -565,6 +565,12 @@
  packages = ["."]
  revision = "62e9147c64a1ed519147b62a56a14e83e2be02c1"

+[[projects]]
+  name = "github.com/fatih/structs"
+  packages = ["."]
+  revision = "4966fc68f5b7593aafa6cbbba2d65ec6e1416047"
+  version = "v1.1.0"
+
 [[projects]]
  branch = "master"
  name = "github.com/flynn/go-shlex"
@@ -819,7 +825,6 @@
  revision = "9b66602d496a139e4722bdde32f0f1ac1c12d4a8"

 [[projects]]
-  branch = "master"
  name = "github.com/jjcollinge/servicefabric"
  packages = ["."]
  revision = "8eebe170fa1ba25d3dfb928b3f86a7313b13b9fe"
@@ -846,6 +851,12 @@
  revision = "59fac5042749a5afb9af70e813da1dd5474f0167"
  version = "1.0.1"

+[[projects]]
+  branch = "master"
+  name = "github.com/kolo/xmlrpc"
+  packages = ["."]
+  revision = "16bdd962781df9696f40cc2bab924f1a855a7f89"
+
 [[projects]]
  branch = "master"
  name = "github.com/konsorten/go-windows-terminal-sequences"
@@ -966,10 +977,10 @@
  source = "https://github.com/containous/mesos-dns.git"

 [[projects]]
-  branch = "master"
  name = "github.com/miekg/dns"
  packages = ["."]
-  revision = "906238edc6eb0ddface4a1923f6d41ef2a5ca59b"
+  revision = "7586a3cbe8ccfc63f82de3ab2ceeb08c9939af72"
+  version = "v1.1.1"

 [[projects]]
  branch = "master"
@@ -990,10 +1001,10 @@
  revision = "2bca23e0e452137f789efbc8610126fd8b94f73b"

 [[projects]]
-  branch = "master"
  name = "github.com/mitchellh/mapstructure"
  packages = ["."]
-  revision = "b4575eea38cca1123ec2dc90c26529b5c5acfcff"
+  revision = "3536a929edddb9a5b34bd6861dc4a9647cb459fe"
+  version = "v1.1.2"

 [[projects]]
  branch = "master"
@@ -1201,6 +1212,12 @@
  revision = "a67f783a3814b8729bd2dac5780b5f78f8dbd64d"
  version = "v1.1.0"

+[[projects]]
+  branch = "master"
+  name = "github.com/smueller18/goinwx"
+  packages = ["."]
+  revision = "5d138389109eca96463f44f692408f0d1c731278"
+
 [[projects]]
  name = "github.com/spf13/pflag"
  packages = ["."]
@@ -1248,6 +1265,16 @@
  revision = "b2b6a672cf1e5b90748f79b8b81fc8c5cf0571a1"
  version = "1.0.2"

+[[projects]]
+  name = "github.com/transip/gotransip"
+  packages = [
+    ".",
+    "domain",
+    "util"
+  ]
+  revision = "1dc93a7db3567a5ccf865106afac88278ba940cf"
+  version = "v5.8.1"
+
 [[projects]]
  branch = "master"
  name = "github.com/tuvistavie/securerandom"
@@ -1323,7 +1350,7 @@
    "roundrobin",
    "utils"
  ]
-  revision = "7d94d212f808222b72fd0b8bb171bfcd4e27ffca"
+  revision = "c34b0c501e43223bc816ac9b40b0ac29c44c8952"

 [[projects]]
  name = "github.com/vulcand/predicate"
@@ -1349,12 +1376,24 @@
  revision = "0c8571ac0ce161a5feb57375a9cdf148c98c0f70"

 [[projects]]
-  branch = "master"
  name = "github.com/xenolf/lego"
  packages = [
    "acme",
+    "acme/api",
+    "acme/api/internal/nonces",
+    "acme/api/internal/secure",
+    "acme/api/internal/sender",
+    "certcrypto",
+    "certificate",
+    "challenge",
+    "challenge/dns01",
+    "challenge/http01",
+    "challenge/resolver",
+    "challenge/tlsalpn01",
+    "lego",
    "log",
    "platform/config/env",
+    "platform/wait",
    "providers/dns",
    "providers/dns/acmedns",
    "providers/dns/alidns",
@@ -1363,9 +1402,13 @@
    "providers/dns/bluecat",
    "providers/dns/cloudflare",
    "providers/dns/cloudxns",
+    "providers/dns/cloudxns/internal",
+    "providers/dns/conoha",
+    "providers/dns/conoha/internal",
    "providers/dns/digitalocean",
    "providers/dns/dnsimple",
    "providers/dns/dnsmadeeasy",
+    "providers/dns/dnsmadeeasy/internal",
    "providers/dns/dnspod",
    "providers/dns/dreamhost",
    "providers/dns/duckdns",
@@ -1379,14 +1422,19 @@
    "providers/dns/glesys",
    "providers/dns/godaddy",
    "providers/dns/hostingde",
+    "providers/dns/httpreq",
    "providers/dns/iij",
+    "providers/dns/inwx",
    "providers/dns/lightsail",
    "providers/dns/linode",
    "providers/dns/linodev4",
+    "providers/dns/mydnsjp",
    "providers/dns/namecheap",
    "providers/dns/namedotcom",
    "providers/dns/netcup",
+    "providers/dns/netcup/internal",
    "providers/dns/nifcloud",
+    "providers/dns/nifcloud/internal",
    "providers/dns/ns1",
    "providers/dns/otc",
    "providers/dns/ovh",
@@ -1395,11 +1443,19 @@
    "providers/dns/rfc2136",
    "providers/dns/route53",
    "providers/dns/sakuracloud",
+    "providers/dns/selectel",
+    "providers/dns/selectel/internal",
    "providers/dns/stackpath",
+    "providers/dns/transip",
    "providers/dns/vegadns",
-    "providers/dns/vultr"
+    "providers/dns/vscale",
+    "providers/dns/vscale/internal",
+    "providers/dns/vultr",
+    "providers/dns/zoneee",
+    "registration"
  ]
-  revision = "1151b4e3befc51b7b215179c87791753721dc6d5"
+  revision = "00ad82dec10ad0af1e037ee652ad1f1cc7015178"
+  version = "v2.1.0"

 [[projects]]
  branch = "master"
@@ -1416,7 +1472,7 @@
    "scrypt",
    "ssh/terminal"
  ]
-  revision = "91a49db82a88618983a78a06c1cbd4e00ab749ab"
+  revision = "505ab145d0a99da450461ae2c1a9f6cd10d1f447"

 [[projects]]
  branch = "master"
@@ -1564,8 +1620,8 @@
    "ddtrace/opentracer",
    "ddtrace/tracer"
  ]
-  revision = "d052956664af54dbcff2712d10c67c76fbfc299f"
-  version = "v1.0.0"
+  revision = "7fb2bce4b1ed6ab61f7a9e1be30dea56de19db7c"
+  version = "v1.8.0"

 [[projects]]
  name = "gopkg.in/fsnotify.v1"
@@ -1824,6 +1880,6 @@
 [solve-meta]
  analyzer-name = "dep"
  analyzer-version = 1
-  inputs-digest = "059f9d29d78e7a800b676c529197fd627de968837b01c663a8a00ee72c36271b"
+  inputs-digest = "781857167b93ec784d40c7c093a46c4d817f2d47b0dbc1f08fe3ec8ffc562cf9"
  solver-name = "gps-cdcl"
  solver-version = 1
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -19,6 +19,11 @@
 #  name = "github.com/x/y"
 #  version = "2.4.0"

+[prune]
+  non-go = true
+  go-tests = true
+  unused-packages = true
+
 [[constraint]]
  branch = "master"
  name = "github.com/ArthurHlt/go-eureka-client"
@@ -54,7 +59,7 @@

 [[constraint]]
  name = "github.com/containous/flaeg"
-  version = "1.3.0"
+  version = "1.4.1"

 [[constraint]]
  branch = "master"
@@ -181,9 +186,9 @@
  name = "github.com/vulcand/oxy"

 [[constraint]]
-  branch = "master"
+#  branch = "master"
  name = "github.com/xenolf/lego"
-#  version = "1.0.0"
+  version = "2.0.1"

 [[constraint]]
  name = "google.golang.org/grpc"
@@ -249,18 +254,13 @@
  revision = "7e6055773c5137efbeb3bd2410d705fe10ab6bfd"

 [[override]]
-  branch = "master"
+  version = "v1.1.1"
  name = "github.com/miekg/dns"

-[prune]
-  non-go = true
-  go-tests = true
-  unused-packages = true
-
 [[constraint]]
  name = "github.com/patrickmn/go-cache"
  version = "2.1.0"

 [[constraint]]
  name = "gopkg.in/DataDog/dd-trace-go.v1"
-  version = "1.0.0"
+  version = "1.7.0"
--- a/9
+++ b/9
@@ -23,6 +23,7 @@ TRAEFIK_IMAGE := $(if $(REPONAME),$(REPONAME),"containous/traefik")
 INTEGRATION_OPTS := $(if $(MAKE_DOCKER_HOST),-e "DOCKER_HOST=$(MAKE_DOCKER_HOST)", -e "TEST_CONTAINER=1" -v "/var/run/docker.sock:/var/run/docker.sock")
 TRAEFIK_DOC_IMAGE := traefik-docs
 TRAEFIK_DOC_VERIFY_IMAGE := $(TRAEFIK_DOC_IMAGE)-verify
+DOCS_VERIFY_SKIP ?= false

 DOCKER_BUILD_ARGS := $(if $(DOCKER_VERSION), "--build-arg=DOCKER_VERSION=$(DOCKER_VERSION)",)
 DOCKER_RUN_OPTS := $(TRAEFIK_ENVS) $(TRAEFIK_MOUNT) "$(TRAEFIK_DEV_IMAGE)"
@@ -104,8 +105,12 @@ docs: docs-image
 docs-build: site

 docs-verify: site
-	docker build -t $(TRAEFIK_DOC_VERIFY_IMAGE) ./script/docs-verify-docker-image ## Build Validator image
-	docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOC_VERIFY_IMAGE) ## Check for dead links and w3c compliance
+ifeq ($(DOCS_VERIFY_SKIP),false)
+	docker build -t $(TRAEFIK_DOC_VERIFY_IMAGE) ./script/docs-verify-docker-image
+	docker run --rm -v $(CURDIR):/app $(TRAEFIK_DOC_VERIFY_IMAGE)
+else
+	@echo "DOCS_LINT_SKIP is true: no linting done."
+endif

 site: docs-image
 	docker run  $(DOCKER_RUN_DOC_OPTS) $(TRAEFIK_DOC_IMAGE) mkdocs build
--- a/README.md
+++ b/README.md
@@ -133,7 +133,7 @@ git clone https://github.com/containous/traefik

 ## Introductory Videos

-Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at [GopherCon 2017](https://gophercon.com/).
+Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at GopherCon 2017.
 You will learn Traefik basics in less than 10 minutes.

 [![Traefik GopherCon 2017](https://img.youtube.com/vi/RgudiksfL-k/0.jpg)](https://www.youtube.com/watch?v=RgudiksfL-k)
--- a/acme/account.go
+++ b/acme/account.go
@@ -17,15 +17,16 @@ import (
 	"github.com/containous/traefik/log"
 	acmeprovider "github.com/containous/traefik/provider/acme"
 	"github.com/containous/traefik/types"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/certcrypto"
+	"github.com/xenolf/lego/registration"
 )

 // Account is used to store lets encrypt registration info
 type Account struct {
 	Email              string
-	Registration       *acme.RegistrationResource
+	Registration       *registration.Resource
 	PrivateKey         []byte
-	KeyType            acme.KeyType
+	KeyType            certcrypto.KeyType
 	DomainsCertificate DomainsCertificates
 	ChallengeCerts     map[string]*ChallengeCert
 	HTTPChallenge      map[string]map[string][]byte
@@ -100,7 +101,7 @@ func (a *Account) GetEmail() string {
 }

 // GetRegistration returns lets encrypt registration resource
-func (a *Account) GetRegistration() *acme.RegistrationResource {
+func (a *Account) GetRegistration() *registration.Resource {
 	return a.Registration
 }

--- a/acme/acme.go
+++ b/acme/acme.go
@@ -28,9 +28,14 @@ import (
 	"github.com/containous/traefik/version"
 	"github.com/eapache/channels"
 	"github.com/sirupsen/logrus"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/certificate"
+	"github.com/xenolf/lego/challenge"
+	"github.com/xenolf/lego/challenge/dns01"
+	"github.com/xenolf/lego/challenge/http01"
+	"github.com/xenolf/lego/lego"
 	legolog "github.com/xenolf/lego/log"
 	"github.com/xenolf/lego/providers/dns"
+	"github.com/xenolf/lego/registration"
 )

 var (
@@ -57,7 +62,7 @@ type ACME struct {
 	DelayDontCheckDNS     flaeg.Duration              `description:"(Deprecated) Assume DNS propagates after a delay in seconds rather than finding and querying nameservers."` // Deprecated
 	ACMELogging           bool                        `description:"Enable debug logging of ACME actions."`
 	OverrideCertificates  bool                        `description:"Enable to override certificates in key-value store when using storeconfig"`
-	client                *acme.Client
+	client                *lego.Client
 	store                 cluster.Store
 	challengeHTTPProvider *challengeHTTPProvider
 	challengeTLSProvider  *challengeTLSProvider
@@ -70,8 +75,6 @@ type ACME struct {
 }

 func (a *ACME) init() error {
-	acme.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
-
 	if a.ACMELogging {
 		legolog.Logger = fmtlog.New(log.WriterLevel(logrus.InfoLevel), "legolog: ", 0)
 	} else {
@@ -89,7 +92,7 @@ func (a *ACME) init() error {
 // AddRoutes add routes on internal router
 func (a *ACME) AddRoutes(router *mux.Router) {
 	router.Methods(http.MethodGet).
-		Path(acme.HTTP01ChallengePath("{token}")).
+		Path(http01.ChallengePath("{token}")).
 		Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 			if a.challengeHTTPProvider == nil {
 				rw.WriteHeader(http.StatusNotFound)
@@ -222,7 +225,7 @@ func (a *ACME) leadershipListener(elected bool) error {
 			// New users will need to register; be sure to save it
 			log.Debug("Register...")

-			reg, err := a.client.Register(true)
+			reg, err := a.client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
 			if err != nil {
 				return err
 			}
@@ -367,7 +370,7 @@ func (a *ACME) renewCertificates() {
 }

 func (a *ACME) renewACMECertificate(certificateResource *DomainsCertificate) (*Certificate, error) {
-	renewedCert, err := a.client.RenewCertificate(acme.CertificateResource{
+	renewedCert, err := a.client.Certificate.Renew(certificate.Resource{
 		Domain:        certificateResource.Certificate.Domain,
 		CertURL:       certificateResource.Certificate.CertURL,
 		CertStableURL: certificateResource.Certificate.CertStableURL,
@@ -416,28 +419,19 @@ func (a *ACME) storeRenewedCertificate(certificateResource *DomainsCertificate,
 	return nil
 }

-func dnsOverrideDelay(delay flaeg.Duration) error {
-	var err error
-	if delay > 0 {
-		log.Debugf("Delaying %d rather than validating DNS propagation", delay)
-		acme.PreCheckDNS = func(_, _ string) (bool, error) {
-			time.Sleep(time.Duration(delay))
-			return true, nil
-		}
-	} else if delay < 0 {
-		err = fmt.Errorf("invalid negative DelayBeforeCheck: %d", delay)
-	}
-	return err
-}
-
-func (a *ACME) buildACMEClient(account *Account) (*acme.Client, error) {
+func (a *ACME) buildACMEClient(account *Account) (*lego.Client, error) {
 	log.Debug("Building ACME client...")
 	caServer := "https://acme-v02.api.letsencrypt.org/directory"
 	if len(a.CAServer) > 0 {
 		caServer = a.CAServer
 	}

-	client, err := acme.NewClient(caServer, account, account.KeyType)
+	config := lego.NewConfig(account)
+	config.CADirURL = caServer
+	config.Certificate.KeyType = account.KeyType
+	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
+
+	client, err := lego.NewClient(config)
 	if err != nil {
 		return nil, err
 	}
@@ -446,22 +440,23 @@ func (a *ACME) buildACMEClient(account *Account) (*acme.Client, error) {
 	if a.DNSChallenge != nil && len(a.DNSChallenge.Provider) > 0 {
 		log.Debugf("Using DNS Challenge provider: %s", a.DNSChallenge.Provider)

-		err = dnsOverrideDelay(a.DNSChallenge.DelayBeforeCheck)
-		if err != nil {
-			return nil, err
-		}
-
-		acmeprovider.SetRecursiveNameServers(a.DNSChallenge.Resolvers)
-		acmeprovider.SetPropagationCheck(a.DNSChallenge.DisablePropagationCheck)
-
-		var provider acme.ChallengeProvider
+		var provider challenge.Provider
 		provider, err = dns.NewDNSChallengeProviderByName(a.DNSChallenge.Provider)
 		if err != nil {
 			return nil, err
 		}

-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSALPN01})
-		err = client.SetChallengeProvider(acme.DNS01, provider)
+		err = client.Challenge.SetDNS01Provider(provider,
+			dns01.CondOption(len(a.DNSChallenge.Resolvers) > 0, dns01.AddRecursiveNameservers(a.DNSChallenge.Resolvers)),
+			dns01.CondOption(a.DNSChallenge.DisablePropagationCheck || a.DNSChallenge.DelayBeforeCheck > 0,
+				dns01.AddPreCheck(func(_, _ string) (bool, error) {
+					if a.DNSChallenge.DelayBeforeCheck > 0 {
+						log.Debugf("Delaying %d rather than validating DNS propagation now.", a.DNSChallenge.DelayBeforeCheck)
+						time.Sleep(time.Duration(a.DNSChallenge.DelayBeforeCheck))
+					}
+					return true, nil
+				})),
+		)
 		return client, err
 	}

@@ -469,17 +464,16 @@ func (a *ACME) buildACMEClient(account *Account) (*acme.Client, error) {
 	if a.HTTPChallenge != nil && len(a.HTTPChallenge.EntryPoint) > 0 {
 		log.Debug("Using HTTP Challenge provider.")

-		client.ExcludeChallenges([]acme.Challenge{acme.DNS01, acme.TLSALPN01})
 		a.challengeHTTPProvider = &challengeHTTPProvider{store: a.store}
-		err = client.SetChallengeProvider(acme.HTTP01, a.challengeHTTPProvider)
+		err = client.Challenge.SetHTTP01Provider(a.challengeHTTPProvider)
 		return client, err
 	}

 	// TLS Challenge
 	if a.TLSChallenge != nil {
 		log.Debug("Using TLS Challenge provider.")
-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
-		err = client.SetChallengeProvider(acme.TLSALPN01, a.challengeTLSProvider)
+
+		err = client.Challenge.SetTLSALPN01Provider(a.challengeTLSProvider)
 		return client, err
 	}

@@ -551,7 +545,7 @@ func (a *ACME) LoadCertificateForDomains(domains []string) {
 		a.addResolvingDomains(uncheckedDomains)
 		defer a.removeResolvingDomains(uncheckedDomains)

-		certificate, err := a.getDomainsCertificates(uncheckedDomains)
+		cert, err := a.getDomainsCertificates(uncheckedDomains)
 		if err != nil {
 			log.Errorf("Error getting ACME certificates %+v : %v", uncheckedDomains, err)
 			return
@@ -570,7 +564,7 @@ func (a *ACME) LoadCertificateForDomains(domains []string) {
 			domain = types.Domain{Main: uncheckedDomains[0]}
 		}
 		account = object.(*Account)
-		_, err = account.DomainsCertificate.addCertificateForDomains(certificate, domain)
+		_, err = account.DomainsCertificate.addCertificateForDomains(cert, domain)
 		if err != nil {
 			log.Errorf("Error adding ACME certificates %+v : %v", uncheckedDomains, err)
 			return
@@ -698,7 +692,7 @@ func (a *ACME) getDomainsCertificates(domains []string) (*Certificate, error) {
 	var cleanDomains []string
 	for _, domain := range domains {
 		canonicalDomain := types.CanonicalDomain(domain)
-		cleanDomain := acme.UnFqdn(canonicalDomain)
+		cleanDomain := dns01.UnFqdn(canonicalDomain)
 		if canonicalDomain != cleanDomain {
 			log.Warnf("FQDN detected, please remove the trailing dot: %s", canonicalDomain)
 		}
@@ -708,18 +702,24 @@ func (a *ACME) getDomainsCertificates(domains []string) (*Certificate, error) {
 	log.Debugf("Loading ACME certificates %s...", cleanDomains)
 	bundle := true

-	certificate, err := a.client.ObtainCertificate(cleanDomains, bundle, nil, OSCPMustStaple)
+	request := certificate.ObtainRequest{
+		Domains:    cleanDomains,
+		Bundle:     bundle,
+		MustStaple: OSCPMustStaple,
+	}
+
+	cert, err := a.client.Certificate.Obtain(request)
 	if err != nil {
 		return nil, fmt.Errorf("cannot obtain certificates: %+v", err)
 	}

 	log.Debugf("Loaded ACME certificates %s", cleanDomains)
 	return &Certificate{
-		Domain:        certificate.Domain,
-		CertURL:       certificate.CertURL,
-		CertStableURL: certificate.CertStableURL,
-		PrivateKey:    certificate.PrivateKey,
-		Certificate:   certificate.Certificate,
+		Domain:        cert.Domain,
+		CertURL:       cert.CertURL,
+		CertStableURL: cert.CertStableURL,
+		PrivateKey:    cert.PrivateKey,
+		Certificate:   cert.Certificate,
 	}, nil
 }

--- a/acme/acme_test.go
+++ b/acme/acme_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/containous/traefik/tls/generate"
 	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
-	"github.com/xenolf/lego/acme"
 )

 func TestDomainsSet(t *testing.T) {
@@ -258,39 +257,10 @@ func TestRemoveDuplicates(t *testing.T) {
 	}
 }

-func TestNoPreCheckOverride(t *testing.T) {
-	acme.PreCheckDNS = nil // Irreversable - but not expecting real calls into this during testing process
-	err := dnsOverrideDelay(0)
-	if err != nil {
-		t.Errorf("Error in dnsOverrideDelay :%v", err)
-	}
-	if acme.PreCheckDNS != nil {
-		t.Error("Unexpected change to acme.PreCheckDNS when leaving DNS verification as is.")
-	}
-}
-
-func TestSillyPreCheckOverride(t *testing.T) {
-	err := dnsOverrideDelay(-5)
-	if err == nil {
-		t.Error("Missing expected error in dnsOverrideDelay!")
-	}
-}
-
-func TestPreCheckOverride(t *testing.T) {
-	acme.PreCheckDNS = nil // Irreversable - but not expecting real calls into this during testing process
-	err := dnsOverrideDelay(5)
-	if err != nil {
-		t.Errorf("Error in dnsOverrideDelay :%v", err)
-	}
-	if acme.PreCheckDNS == nil {
-		t.Error("No change to acme.PreCheckDNS when meant to be adding enforcing override function.")
-	}
-}
-
 func TestAcmeClientCreation(t *testing.T) {
-	acme.PreCheckDNS = nil // Irreversable - but not expecting real calls into this during testing process
 	// Lengthy setup to avoid external web requests - oh for easier golang testing!
 	account := &Account{Email: "f@f"}
+
 	account.PrivateKey, _ = base64.StdEncoding.DecodeString(`
 MIIBPAIBAAJBAMp2Ni92FfEur+CAvFkgC12LT4l9D53ApbBpDaXaJkzzks+KsLw9zyAxvlrfAyTCQ
 7tDnEnIltAXyQ0uOFUUdcMCAwEAAQJAK1FbipATZcT9cGVa5x7KD7usytftLW14heQUPXYNV80r/3
@@ -298,8 +268,9 @@ lmnpvjL06dffRpwkYeN8DATQF/QOcy3NNNGDw/4QIhAPAKmiZFxA/qmRXsuU8Zhlzf16WrNZ68K64
 asn/h3qZrAiEA1+wFR3WXCPIolOvd7AHjfgcTKQNkoMPywU4FYUNQ1AkCIQDv8yk0qPjckD6HVCPJ
 llJh9MC0svjevGtNlxJoE3lmEQIhAKXy1wfZ32/XtcrnENPvi6lzxI0T94X7s5pP3aCoPPoJAiEAl
 cijFkALeQp/qyeXdFld2v9gUN3eCgljgcl0QweRoIc=---`)
+
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.Write([]byte(`{
+		_, err := w.Write([]byte(`{
  "GPHhmRVEDas": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://foo/acme/key-change",
  "meta": {
@@ -310,9 +281,20 @@ cijFkALeQp/qyeXdFld2v9gUN3eCgljgcl0QweRoIc=---`)
  "newOrder": "https://foo/acme/new-order",
  "revokeCert": "https://foo/acme/revoke-cert"
 }`))
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
 	}))
 	defer ts.Close()
-	a := ACME{DNSChallenge: &acmeprovider.DNSChallenge{Provider: "manual", DelayBeforeCheck: 10}, CAServer: ts.URL}
+
+	a := ACME{
+		CAServer: ts.URL,
+		DNSChallenge: &acmeprovider.DNSChallenge{
+			Provider:                "manual",
+			DelayBeforeCheck:        10,
+			DisablePropagationCheck: true,
+		},
+	}

 	client, err := a.buildACMEClient(account)
 	if err != nil {
@@ -321,9 +303,6 @@ cijFkALeQp/qyeXdFld2v9gUN3eCgljgcl0QweRoIc=---`)
 	if client == nil {
 		t.Error("No client from buildACMEClient!")
 	}
-	if acme.PreCheckDNS == nil {
-		t.Error("No change to acme.PreCheckDNS when meant to be adding enforcing override function.")
-	}
 }

 func TestAcme_getUncheckedCertificates(t *testing.T) {
--- a/acme/challenge_http_provider.go
+++ b/acme/challenge_http_provider.go
@@ -9,10 +9,10 @@ import (
 	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/challenge"
 )

-var _ acme.ChallengeProviderTimeout = (*challengeHTTPProvider)(nil)
+var _ challenge.ProviderTimeout = (*challengeHTTPProvider)(nil)

 type challengeHTTPProvider struct {
 	store cluster.Store
--- a/acme/challenge_tls_provider.go
+++ b/acme/challenge_tls_provider.go
@@ -11,10 +11,11 @@ import (
 	"github.com/containous/traefik/cluster"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/challenge"
+	"github.com/xenolf/lego/challenge/tlsalpn01"
 )

-var _ acme.ChallengeProviderTimeout = (*challengeTLSProvider)(nil)
+var _ challenge.ProviderTimeout = (*challengeTLSProvider)(nil)

 type challengeTLSProvider struct {
 	store cluster.Store
@@ -113,7 +114,7 @@ func (c *challengeTLSProvider) Timeout() (timeout, interval time.Duration) {
 }

 func tlsALPN01ChallengeCert(domain, keyAuth string) (*ChallengeCert, error) {
-	tempCertPEM, rsaPrivPEM, err := acme.TLSALPNChallengeBlocks(domain, keyAuth)
+	tempCertPEM, rsaPrivPEM, err := tlsalpn01.ChallengeBlocks(domain, keyAuth)
 	if err != nil {
 		return nil, err
 	}
--- a/autogen/gentemplates/gen.go
+++ b/autogen/gentemplates/gen.go
@@ -236,6 +236,18 @@ var _templatesConsul_catalogTmpl = []byte(`[backends]
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."frontend-{{ $service.ServiceName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -719,6 +731,18 @@ var _templatesDockerTmpl = []byte(`{{$backendServers := .Servers}}
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Issuer }}
+        {{if $issuer }}
+        [frontends."frontend-{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -1055,6 +1079,18 @@ var _templatesEcsTmpl = []byte(`[backends]
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Issuer }}
+        {{if $issuer }}
+        [frontends."frontend-{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -1422,6 +1458,18 @@ var _templatesKubernetesTmpl = []byte(`[backends]
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -1609,6 +1657,18 @@ var _templatesKvTmpl = []byte(`[backends]
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -1985,6 +2045,18 @@ var _templatesMarathonTmpl = []byte(`{{ $apps := .Applications }}
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -2305,6 +2377,18 @@ var _templatesMesosTmpl = []byte(`[backends]
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."frontend-{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
@@ -2678,6 +2762,18 @@ var _templatesRancherTmpl = []byte(`{{ $backendServers := .Backends }}
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."frontend-{{ $frontendName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
--- a/build.Dockerfile
+++ b/build.Dockerfile
@@ -4,8 +4,7 @@ RUN apk --update upgrade \
 && apk --no-cache --no-progress add git mercurial bash gcc musl-dev curl tar \
 && rm -rf /var/cache/apk/*

-RUN go get github.com/containous/go-bindata/... \
-&& go get golang.org/x/lint/golint \
+RUN go get golang.org/x/lint/golint \
 && go get github.com/kisielk/errcheck \
 && go get github.com/client9/misspell/cmd/misspell

@@ -13,6 +12,11 @@ RUN go get github.com/containous/go-bindata/... \
 ARG DOCKER_VERSION=17.03.2
 ARG DEP_VERSION=0.4.1

+# Download go-bindata binary to bin folder in $GOPATH
+RUN mkdir -p /usr/local/bin \
+    && curl -fsSL -o /usr/local/bin/go-bindata https://github.com/containous/go-bindata/releases/download/v1.0.0/go-bindata \
+    && chmod +x /usr/local/bin/go-bindata
+
 # Download dep binary to bin folder in $GOPATH
 RUN mkdir -p /usr/local/bin \
    && curl -fsSL -o /usr/local/bin/dep https://github.com/golang/dep/releases/download/v${DEP_VERSION}/dep-linux-amd64 \
--- a/cmd/configuration.go
+++ b/cmd/configuration.go
@@ -46,6 +46,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 	defaultDocker.ExposedByDefault = true
 	defaultDocker.Endpoint = "unix:///var/run/docker.sock"
 	defaultDocker.SwarmMode = false
+	defaultDocker.SwarmModeRefreshSeconds = 15

 	// default File
 	var defaultFile file.Provider
@@ -238,6 +239,7 @@ func NewTraefikDefaultPointersConfiguration() *TraefikConfiguration {
 			LocalAgentHostPort: "localhost:8126",
 			GlobalTag:          "",
 			Debug:              false,
+			PrioritySampling:   false,
 		},
 	}

--- a/configuration/configuration.go
+++ b/configuration/configuration.go
@@ -34,7 +34,7 @@ import (
 	"github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 	"github.com/pkg/errors"
-	lego "github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/challenge/dns01"
 )

 const (
@@ -235,6 +235,10 @@ func (gc *GlobalConfiguration) SetEffectiveConfiguration(configFile string) {
 		} else {
 			gc.Docker.TemplateVersion = 2
 		}
+
+		if gc.Docker.SwarmModeRefreshSeconds <= 0 {
+			gc.Docker.SwarmModeRefreshSeconds = 15
+		}
 	}

 	if gc.Marathon != nil {
@@ -368,6 +372,7 @@ func (gc *GlobalConfiguration) initTracing() {
 					LocalAgentHostPort: "localhost:8126",
 					GlobalTag:          "",
 					Debug:              false,
+					PrioritySampling:   false,
 				}
 			}
 			if gc.Tracing.Zipkin != nil {
@@ -405,11 +410,11 @@ func (gc *GlobalConfiguration) initACMEProvider() {
 		}

 		for _, domain := range gc.ACME.Domains {
-			if domain.Main != lego.UnFqdn(domain.Main) {
+			if domain.Main != dns01.UnFqdn(domain.Main) {
 				log.Warnf("FQDN detected, please remove the trailing dot: %s", domain.Main)
 			}
 			for _, san := range domain.SANs {
-				if san != lego.UnFqdn(san) {
+				if san != dns01.UnFqdn(san) {
 					log.Warnf("FQDN detected, please remove the trailing dot: %s", san)
 				}
 			}
--- a/contrib/scripts/dumpcerts.sh
+++ b/contrib/scripts/dumpcerts.sh
@@ -155,7 +155,8 @@ echo -e "-----BEGIN RSA PRIVATE KEY-----\n${priv}\n-----END RSA PRIVATE KEY-----
   | openssl rsa -inform pem -out "${pdir}/letsencrypt.key"

 # Process the certificates for each of the domains in acme.json
-for domain in $(jq -r '.Certificates[].Domain.Main' ${acmefile}); do
+domains=$(jq -r '.Certificates[].Domain.Main' ${acmefile}) || bad_acme
+for domain in $domains; do
 	# Traefik stores a cert bundle for each domain.  Within this cert
 	# bundle there is both proper the certificate and the Let's Encrypt CA
 	echo "Extracting cert bundle for ${domain}"
--- a/contrib/systemd/traefik.service
+++ b/contrib/systemd/traefik.service
@@ -1,11 +1,41 @@
 [Unit]
 Description=Traefik
+Documentation=https://docs.traefik.io
+#After=network-online.target
+#AssertFileIsExecutable=/usr/bin/traefik
+#AssertPathExists=/etc/traefik/traefik.toml

 [Service]
+# Run traefik as its own user (create new user with: useradd -r -s /bin/false -U -M traefik)
+#User=traefik
+#AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+# configure service behavior
 Type=notify
-ExecStart=/usr/bin/traefik --configFile=/etc/traefik.toml
+#ExecStart=/usr/bin/traefik --configFile=/etc/traefik/traefik.toml
 Restart=always
 WatchdogSec=1s

+# lock down system access
+# prohibit any operating system and configuration modification
+#ProtectSystem=strict
+# create separate, new (and empty) /tmp and /var/tmp filesystems
+#PrivateTmp=true
+# make /home directories inaccessible
+#ProtectHome=true
+# turns off access to physical devices (/dev/...)
+#PrivateDevices=true
+# make kernel settings (procfs and sysfs) read-only
+#ProtectKernelTunables=true
+# make cgroups /sys/fs/cgroup read-only
+#ProtectControlGroups=true
+
+# allow writing of acme.json
+#ReadWritePaths=/etc/traefik/acme.json
+# depending on log and entrypoint configuration, you may need to allow writing to other paths, too
+
+# limit number of processes in this unit
+#LimitNPROC=1
+
 [Install]
 WantedBy=multi-user.target
--- a/docs/basics.md
+++ b/docs/basics.md
@@ -94,10 +94,12 @@ Following is the list of existing modifier rules:

 Matcher rules determine if a particular request should be forwarded to a backend.

-Separate multiple rule values by `,` (comma) in order to enable ANY semantics (i.e., forward a request if any rule matches).
-Does not work for `Headers` and `HeadersRegexp`.
-
-Separate multiple rule values by `;` (semicolon) in order to enable ALL semantics (i.e., forward a request if all rules match).
+The associativity rule is the following:
+- `,` is the `OR` operator (works **only inside a matcher**, ex: `Host:foo.com,bar.com`).
+    - i.e., forward a request if any rule matches.
+    - Does not work for `Headers` and `HeadersRegexp`.
+- `;` is the `AND` operator (works **only between matchers**, ex: `Host:foo.com;Path:/bar`) 
+    - i.e., forward a request if all rules match

 Following is the list of existing matcher rules along with examples:

@@ -234,7 +236,8 @@ The following rules are both `Matchers` and `Modifiers`, so the `Matcher` portio
 #### Priorities

 By default, routes will be sorted (in descending order) using rules length (to avoid path overlap):
-`PathPrefix:/foo;Host:foo.com` (length == 28) will be matched before `PathPrefixStrip:/foobar` (length == 23) will be matched before `PathPrefix:/foo,/bar` (length == 20).
+- `PathPrefix:/foo;Host:foo.com` (length == 28) will be matched before `PathPrefixStrip:/foobar` (length == 23) will be matched before `PathPrefix:/foo,/bar` (length == 20).  
+- A priority value of 0 will be ignored, so the default value will be calculated (rules length).

 You can customize priority by frontend. The priority value override the rule length during sorting:

@@ -746,8 +749,6 @@ If you want to dig into more details, here is the source code of the collecting

 By default we anonymize all configuration fields, except fields tagged with `export=true`.

-You can check all fields in the [godoc](https://godoc.org/github.com/containous/traefik/configuration#GlobalConfiguration).
-
 ### How to enable this ?

 You can enable the collecting system by:
--- a/docs/configuration/acme.md
+++ b/docs/configuration/acme.md
@@ -275,34 +275,38 @@ Here is a list of supported `provider`s, that can automate the DNS verification,

 | Provider Name                                          | Provider Code  | Environment Variables                                                                                                                     | Wildcard & Root Domain Support |
 |--------------------------------------------------------|----------------|-------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------|
-| [ACME DNS](https://github.com/joohoi/acme-dns)         | `acmedns`      | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                              | Not tested yet                 |
+| [ACME DNS](https://github.com/joohoi/acme-dns)         | `acme-dns`     | `ACME_DNS_API_BASE`, `ACME_DNS_STORAGE_PATH`                                                                                              | Not tested yet                 |
 | [Alibaba Cloud](https://www.vultr.com)                 | `alidns`       | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY`, `ALICLOUD_REGION_ID`                                                                        | Not tested yet                 |
 | [Auroradns](https://www.pcextreme.com/aurora/dns)      | `auroradns`    | `AURORA_USER_ID`, `AURORA_KEY`, `AURORA_ENDPOINT`                                                                                         | Not tested yet                 |
 | [Azure](https://azure.microsoft.com/services/dns/)     | `azure`        | `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_RESOURCE_GROUP`, `[AZURE_METADATA_ENDPOINT]` | Not tested yet                 |
 | [Blue Cat](https://www.bluecatnetworks.com/)           | `bluecat`      | `BLUECAT_SERVER_URL`, `BLUECAT_USER_NAME`, `BLUECAT_PASSWORD`, `BLUECAT_CONFIG_NAME`, `BLUECAT_DNS_VIEW`                                  | Not tested yet                 |
 | [Cloudflare](https://www.cloudflare.com)               | `cloudflare`   | `CF_API_EMAIL`, `CF_API_KEY` - The `Global API Key` needs to be used, not the `Origin CA Key`                                             | YES                            |
 | [CloudXNS](https://www.cloudxns.net)                   | `cloudxns`     | `CLOUDXNS_API_KEY`, `CLOUDXNS_SECRET_KEY`                                                                                                 | Not tested yet                 |
+| [ConoHa](https://www.conoha.jp)                        | `conoha`       | `CONOHA_TENANT_ID`, `CONOHA_API_USERNAME`, `CONOHA_API_PASSWORD`                                                                          | YES                            |
 | [DigitalOcean](https://www.digitalocean.com)           | `digitalocean` | `DO_AUTH_TOKEN`                                                                                                                           | YES                            |
-| [DNSimple](https://dnsimple.com)                       | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                               | Not tested yet                 |
+| [DNSimple](https://dnsimple.com)                       | `dnsimple`     | `DNSIMPLE_OAUTH_TOKEN`, `DNSIMPLE_BASE_URL`                                                                                               | YES                            |
 | [DNS Made Easy](https://dnsmadeeasy.com)               | `dnsmadeeasy`  | `DNSMADEEASY_API_KEY`, `DNSMADEEASY_API_SECRET`, `DNSMADEEASY_SANDBOX`                                                                    | Not tested yet                 |
-| [DNSPod](http://www.dnspod.net/)                       | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                          | Not tested yet                 |
+| [DNSPod](https://www.dnspod.com/)                      | `dnspod`       | `DNSPOD_API_KEY`                                                                                                                          | Not tested yet                 |
 | [DreamHost](https://www.dreamhost.com/)                | `dreamhost`    | `DREAMHOST_API_KEY`                                                                                                                       | YES                            |
-| [Duck DNS](https://www.duckdns.org/)                   | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                           | No                             |
+| [Duck DNS](https://www.duckdns.org/)                   | `duckdns`      | `DUCKDNS_TOKEN`                                                                                                                           | YES                            |
 | [Dyn](https://dyn.com)                                 | `dyn`          | `DYN_CUSTOMER_NAME`, `DYN_USER_NAME`, `DYN_PASSWORD`                                                                                      | Not tested yet                 |
-| External Program                                       | `exec`         | `EXEC_PATH`                                                                                                                               | Not tested yet                 |
+| External Program                                       | `exec`         | `EXEC_PATH`                                                                                                                               | YES                            |
 | [Exoscale](https://www.exoscale.com)                   | `exoscale`     | `EXOSCALE_API_KEY`, `EXOSCALE_API_SECRET`, `EXOSCALE_ENDPOINT`                                                                            | YES                            |
 | [Fast DNS](https://www.akamai.com/)                    | `fastdns`      | `AKAMAI_CLIENT_TOKEN`,  `AKAMAI_CLIENT_SECRET`,  `AKAMAI_ACCESS_TOKEN`                                                                    | Not tested yet                 |
 | [Gandi](https://www.gandi.net)                         | `gandi`        | `GANDI_API_KEY`                                                                                                                           | Not tested yet                 |
 | [Gandi v5](http://doc.livedns.gandi.net)               | `gandiv5`      | `GANDIV5_API_KEY`                                                                                                                         | YES                            |
 | [Glesys](https://glesys.com/)                          | `glesys`       | `GLESYS_API_USER`, `GLESYS_API_KEY`, `GLESYS_DOMAIN`                                                                                      | Not tested yet                 |
 | [GoDaddy](https://godaddy.com/domains)                 | `godaddy`      | `GODADDY_API_KEY`, `GODADDY_API_SECRET`                                                                                                   | Not tested yet                 |
-| [Google Cloud DNS](https://cloud.google.com/dns/docs/) | `gcloud`       | `GCE_PROJECT`, `GCE_SERVICE_ACCOUNT_FILE`                                                                                                 | YES                            |
+| [Google Cloud DNS](https://cloud.google.com/dns/docs/) | `gcloud`       | `GCE_PROJECT`, Application Default Credentials (2) (3), [`GCE_SERVICE_ACCOUNT_FILE`]                                                      | YES                            |
 | [hosting.de](https://www.hosting.de)                   | `hostingde`    | `HOSTINGDE_API_KEY`, `HOSTINGDE_ZONE_NAME`                                                                                                | Not tested yet                 |
+| HTTP request                                           | `httpreq`      | `HTTPREQ_ENDPOINT`, `HTTPREQ_MODE`, `HTTPREQ_USERNAME`, `HTTPREQ_PASSWORD` (1)                                                            | YES                            |
 | [IIJ](https://www.iij.ad.jp/)                          | `iij`          | `IIJ_API_ACCESS_KEY`, `IIJ_API_SECRET_KEY`, `IIJ_DO_SERVICE_CODE`                                                                         | Not tested yet                 |
+| [INWX](https://www.inwx.de/en)                         | `inwx`         | `INWX_USERNAME`, `INWX_PASSWORD`                                                                                                          | YES                            |
 | [Lightsail](https://aws.amazon.com/lightsail/)         | `lightsail`    | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `DNS_ZONE`                                                                                  | Not tested yet                 |
 | [Linode](https://www.linode.com)                       | `linode`       | `LINODE_API_KEY`                                                                                                                          | Not tested yet                 |
 | [Linode v4](https://www.linode.com)                    | `linodev4`     | `LINODE_TOKEN`                                                                                                                            | Not tested yet                 |
 | manual                                                 | -              | none, but you need to run Traefik interactively, turn on `acmeLogging` to see instructions and press <kbd>Enter</kbd>.                    | YES                            |
+| [MyDNS.jp](https://www.mydns.jp/)                      | `mydnsjp`      | `MYDNSJP_MASTER_ID`, `MYDNSJP_PASSWORD`                                                                                                   | YES                            |
 | [Namecheap](https://www.namecheap.com)                 | `namecheap`    | `NAMECHEAP_API_USER`, `NAMECHEAP_API_KEY`                                                                                                 | YES                            |
 | [name.com](https://www.name.com/)                      | `namedotcom`   | `NAMECOM_USERNAME`, `NAMECOM_API_TOKEN`, `NAMECOM_SERVER`                                                                                 | Not tested yet                 |
 | [Netcup](https://www.netcup.eu/)                       | `netcup`       | `NETCUP_CUSTOMER_NUMBER`, `NETCUP_API_KEY`, `NETCUP_API_PASSWORD`                                                                         | Not tested yet                 |
@@ -315,14 +319,30 @@ Here is a list of supported `provider`s, that can automate the DNS verification,
 | [RFC2136](https://tools.ietf.org/html/rfc2136)         | `rfc2136`      | `RFC2136_TSIG_KEY`, `RFC2136_TSIG_SECRET`, `RFC2136_TSIG_ALGORITHM`, `RFC2136_NAMESERVER`                                                 | Not tested yet                 |
 | [Route 53](https://aws.amazon.com/route53/)            | `route53`      | `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `[AWS_REGION]`, `[AWS_HOSTED_ZONE_ID]` or a configured user/instance IAM profile.           | YES                            |
 | [Sakura Cloud](https://cloud.sakura.ad.jp/)            | `sakuracloud`  | `SAKURACLOUD_ACCESS_TOKEN`, `SAKURACLOUD_ACCESS_TOKEN_SECRET`                                                                             | Not tested yet                 |
+| [Selectel](https://selectel.ru/en/)                    | `selectel`     | `SELECTEL_API_TOKEN`                                                                                                                      | YES                            |
 | [Stackpath](https://www.stackpath.com/)                | `stackpath`    | `STACKPATH_CLIENT_ID`, `STACKPATH_CLIENT_SECRET`, `STACKPATH_STACK_ID`                                                                    | Not tested yet                 |
+| [TransIP](https://www.transip.nl/)                     | `transip`      | `TRANSIP_ACCOUNT_NAME`, `TRANSIP_PRIVATE_KEY_PATH`                                                                                        | YES                            |
 | [VegaDNS](https://github.com/shupp/VegaDNS-API)        | `vegadns`      | `SECRET_VEGADNS_KEY`, `SECRET_VEGADNS_SECRET`, `VEGADNS_URL`                                                                              | Not tested yet                 |
+| [Vscale](https://vscale.io/)                           | `vscale`       | `VSCALE_API_TOKEN`                                                                                                                        | YES                            |
 | [VULTR](https://www.vultr.com)                         | `vultr`        | `VULTR_API_KEY`                                                                                                                           | Not tested yet                 |
+| [Zone.ee](https://www.zone.ee)                         | `zoneee`       | `ZONEEE_API_USER`, `ZONEEE_API_KEY`                                                                                                       | YES                            |
+
+- (1): more information about the HTTP message format can be found [here](https://github.com/xenolf/lego/blob/master/providers/dns/httpreq/readme.md)
+- (2): https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_application
+- (3): https://github.com/golang/oauth2/blob/36a7019397c4c86cf59eeab3bc0d188bac444277/google/default.go#L61-L76

 #### `resolvers`

 Use custom DNS servers to resolve the FQDN authority.

+```toml
+[acme]
+# ...
+[acme.dnsChallenge]
+  # ...
+  resolvers = ["1.1.1.1:53", "8.8.8.8:53"]
+```
+
 ### `domains`

 You can provide SANs (alternative domains) to each main domain.
--- a/docs/configuration/api.md
+++ b/docs/configuration/api.md
@@ -106,10 +106,10 @@ entryPoint = "foo"
 entryPoint = "bar"
 ```

-In the above example, you would access a regular path, administration panel, and health-check as follows:
+In the above example, you would access a regular path, dashboard, and health-check as follows:

 * Regular path: `http://hostname:80/path`
-* Admin Panel: `http://hostname:8083/`
+* Dashboard: `http://hostname:8083/`
 * Ping URL: `http://hostname:8082/ping`

 In the above example, it is _very_ important to create a named dedicated entry point, and do **not** include it in `defaultEntryPoints`.
@@ -301,7 +301,7 @@ curl -s "http://localhost:8080/health" | jq .
  // average response time in seconds
  "average_response_time_sec": 0.8648016000000001,

-  // request statistics [requires --statistics to be set]
+  // request statistics [requires --api.statistics to be set]
  // ten most recent requests with 4xx and 5xx status codes
  "recent_errors": [
    {
--- a/docs/configuration/backends/consulcatalog.md
+++ b/docs/configuration/backends/consulcatalog.md
@@ -94,74 +94,82 @@ Additional settings can be defined using Consul Catalog tags.
 !!! note
    The default prefix is `traefik`.

-| Label                                                                | Description                                                                                                                                                                                                                   |
-|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `<prefix>.enable=false`                                              | Disables this container in Traefik.                                                                                                                                                                                            |
-| `<prefix>.protocol=https`                                            | Overrides the default `http` protocol.                                                                                                                                                                                        |
-| `<prefix>.weight=10`                                                 | Assigns this weight to the container.                                                                                                                                                                                         |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memRequestBodyBytes=0`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memResponseBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.retryExpression=EXPR`                     | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `<prefix>.backend.circuitbreaker.expression=EXPR`                    | Creates a [circuit breaker](/basics/#backends) to be used against the backend. ex: `NetworkErrorRatio() > 0.`                                                                                                                 |
-| `<prefix>.backend.responseForwarding.flushInterval=10ms`             | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
-| `<prefix>.backend.healthcheck.path=/health`                          | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
-| `<prefix>.backend.healthcheck.interval=1s`                           | Defines the health check interval.                                                                                                                                                                                            |
-| `<prefix>.backend.healthcheck.port=8080`                             | Sets a different port for the health check.                                                                                                                                                                                   |
-| `traefik.backend.healthcheck.scheme=http`                            | Overrides the server URL scheme.                                                                                                                                                                                              |
-| `<prefix>.backend.healthcheck.hostname=foobar.com`                   | Defines the health check hostname.                                                                                                                                                                                            |
-| `<prefix>.backend.healthcheck.headers=EXPR`                          | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
-| `<prefix>.backend.loadbalancer.method=drr`                           | Overrides the default `wrr` load balancer algorithm.                                                                                                                                                                          |
-| `<prefix>.backend.loadbalancer.stickiness=true`                      | Enables backend sticky sessions.                                                                                                                                                                                              |
-| `<prefix>.backend.loadbalancer.stickiness.cookieName=NAME`           | Sets the cookie name manually for sticky sessions.                                                                                                                                                                            |
-| `<prefix>.backend.loadbalancer.sticky=true`                          | Enables backend sticky sessions. (DEPRECATED)                                                                                                                                                                                 |
-| `<prefix>.backend.maxconn.amount=10`                                 | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
-| `<prefix>.backend.maxconn.extractorfunc=client.ip`                   | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
-| `<prefix>.frontend.auth.basic=EXPR`                                  | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
-| `<prefix>.frontend.auth.basic.removeHeader=true`                     | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `<prefix>.frontend.auth.basic.users=EXPR`                            | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
-| `<prefix>.frontend.auth.basic.usersfile=/path/.htpasswd`             | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
-| `<prefix>.frontend.auth.digest.removeHeader=true`                    | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `<prefix>.frontend.auth.digest.users=EXPR`                           | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
-| `<prefix>.frontend.auth.digest.usersfile=/path/.htdigest`            | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
-| `<prefix>.frontend.auth.forward.address=https://example.com`         | Sets the URL of the authentication server.                                                                                                                                                                                    |
-| `<prefix>.frontend.auth.forward.authResponseHeaders=EXPR`            | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
-| `<prefix>.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
-| `<prefix>.frontend.auth.forward.tls.caOptional=true`                 | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
-| `<prefix>.frontend.auth.forward.tls.cert=/path/server.pem`           | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `<prefix>.frontend.auth.forward.tls.insecureSkipVerify=true`         | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
-| `<prefix>.frontend.auth.forward.tls.key=/path/server.key`            | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `<prefix>.frontend.auth.forward.trustForwardHeader=true`             | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
-| `<prefix>.frontend.auth.headerField=X-WebAuth-User`                  | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
-| `<prefix>.frontend.entryPoints=http,https`                           | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
-| `<prefix>.frontend.errors.<name>.backend=NAME`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `<prefix>.frontend.errors.<name>.query=PATH`                         | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `<prefix>.frontend.errors.<name>.status=RANGE`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `<prefix>.frontend.passHostHeader=true`                              | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
-| `<prefix>.frontend.passTLSClientCert.infos.notAfter=true`            | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
-| `<prefix>.frontend.passTLSClientCert.infos.notBefore=true`           | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
-| `<prefix>.frontend.passTLSClientCert.infos.sans=true`                | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
-| `<prefix>.frontend.passTLSClientCert.infos.subject.commonName=true`  | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
-| `<prefix>.frontend.passTLSClientCert.infos.subject.country=true`     | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
-| `<prefix>.frontend.passTLSClientCert.infos.subject.locality=true`    | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `<prefix>.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `<prefix>.frontend.passTLSClientCert.infos.subject.province=true`    | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `<prefix>.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `<prefix>.frontend.passTLSClientCert.pem=true`                       | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
-| `<prefix>.frontend.passTLSCert=true`                                 | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
-| `<prefix>.frontend.priority=10`                                      | Overrides default frontend priority.                                                                                                                                                                                          |
-| `<prefix>.frontend.rateLimit.extractorFunc=EXP`                      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `<prefix>.frontend.rateLimit.rateSet.<name>.period=6`                | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `<prefix>.frontend.rateLimit.rateSet.<name>.average=6`               | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `<prefix>.frontend.rateLimit.rateSet.<name>.burst=6`                 | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `<prefix>.frontend.redirect.entryPoint=https`                        | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS).                                                                                                                                                         |
-| `<prefix>.frontend.redirect.regex=^http://localhost/(.*)`            | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
-| `<prefix>.frontend.redirect.replacement=http://mydomain/$1`          | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
-| `<prefix>.frontend.redirect.permanent=true`                          | Returns 301 instead of 302.                                                                                                                                                                                                   |
-| `<prefix>.frontend.rule=EXPR`                                        | Overrides the default frontend rule. Default: `Host:{{.ServiceName}}.{{.Domain}}`.                                                                                                                                            |
-| `<prefix>.frontend.whiteList.sourceRange=RANGE`                      | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `<prefix>.frontend.whiteList.useXForwardedFor=true`                  | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |
+| Label                                                                    | Description                                                                                                                                                                                                                   |
+|--------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `<prefix>.enable=false`                                                  | Disables this container in Traefik.                                                                                                                                                                                           |
+| `<prefix>.protocol=https`                                                | Overrides the default `http` protocol.                                                                                                                                                                                        |
+| `<prefix>.weight=10`                                                     | Assigns this weight to the container.                                                                                                                                                                                         |
+| `traefik.backend.buffering.maxRequestBodyBytes=0`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.maxResponseBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memRequestBodyBytes=0`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memResponseBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.retryExpression=EXPR`                         | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `<prefix>.backend.circuitbreaker.expression=EXPR`                        | Creates a [circuit breaker](/basics/#backends) to be used against the backend. ex: `NetworkErrorRatio() > 0.`                                                                                                                 |
+| `<prefix>.backend.responseForwarding.flushInterval=10ms`                 | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
+| `<prefix>.backend.healthcheck.path=/health`                              | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
+| `<prefix>.backend.healthcheck.interval=1s`                               | Defines the health check interval.                                                                                                                                                                                            |
+| `<prefix>.backend.healthcheck.port=8080`                                 | Sets a different port for the health check.                                                                                                                                                                                   |
+| `traefik.backend.healthcheck.scheme=http`                                | Overrides the server URL scheme.                                                                                                                                                                                              |
+| `<prefix>.backend.healthcheck.hostname=foobar.com`                       | Defines the health check hostname.                                                                                                                                                                                            |
+| `<prefix>.backend.healthcheck.headers=EXPR`                              | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
+| `<prefix>.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm.                                                                                                                                                                          |
+| `<prefix>.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions.                                                                                                                                                                                              |
+| `<prefix>.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions.                                                                                                                                                                            |
+| `<prefix>.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions. (DEPRECATED)                                                                                                                                                                                 |
+| `<prefix>.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
+| `<prefix>.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
+| `<prefix>.frontend.auth.basic=EXPR`                                      | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
+| `<prefix>.frontend.auth.basic.removeHeader=true`                         | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `<prefix>.frontend.auth.basic.users=EXPR`                                | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
+| `<prefix>.frontend.auth.basic.usersfile=/path/.htpasswd`                 | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
+| `<prefix>.frontend.auth.digest.removeHeader=true`                        | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `<prefix>.frontend.auth.digest.users=EXPR`                               | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
+| `<prefix>.frontend.auth.digest.usersfile=/path/.htdigest`                | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
+| `<prefix>.frontend.auth.forward.address=https://example.com`             | Sets the URL of the authentication server.                                                                                                                                                                                    |
+| `<prefix>.frontend.auth.forward.authResponseHeaders=EXPR`                | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
+| `<prefix>.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
+| `<prefix>.frontend.auth.forward.tls.caOptional=true`                     | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
+| `<prefix>.frontend.auth.forward.tls.cert=/path/server.pem`               | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `<prefix>.frontend.auth.forward.tls.insecureSkipVerify=true`             | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
+| `<prefix>.frontend.auth.forward.tls.key=/path/server.key`                | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `<prefix>.frontend.auth.forward.trustForwardHeader=true`                 | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
+| `<prefix>.frontend.auth.headerField=X-WebAuth-User`                      | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
+| `<prefix>.frontend.entryPoints=http,https`                               | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
+| `<prefix>.frontend.errors.<name>.backend=NAME`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `<prefix>.frontend.errors.<name>.query=PATH`                             | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `<prefix>.frontend.errors.<name>.status=RANGE`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `<prefix>.frontend.passHostHeader=true`                                  | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.country=true`          | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                     |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                             |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.locality=true`         | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.organization=true`     | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.province=true`         | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `<prefix>.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `<prefix>.frontend.passTLSClientCert.infos.notAfter=true`                | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
+| `<prefix>.frontend.passTLSClientCert.infos.notBefore=true`               | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
+| `<prefix>.frontend.passTLSClientCert.infos.sans=true`                    | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.commonName=true`      | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.country=true`         | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                            |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.locality=true`        | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.organization=true`    | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.province=true`        | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `<prefix>.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `<prefix>.frontend.passTLSClientCert.pem=true`                           | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
+| `<prefix>.frontend.passTLSCert=true`                                     | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
+| `<prefix>.frontend.priority=10`                                          | Overrides default frontend priority.                                                                                                                                                                                          |
+| `<prefix>.frontend.rateLimit.extractorFunc=EXP`                          | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `<prefix>.frontend.rateLimit.rateSet.<name>.period=6`                    | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `<prefix>.frontend.rateLimit.rateSet.<name>.average=6`                   | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `<prefix>.frontend.rateLimit.rateSet.<name>.burst=6`                     | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `<prefix>.frontend.redirect.entryPoint=https`                            | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS).                                                                                                                                                         |
+| `<prefix>.frontend.redirect.regex=^http://localhost/(.*)`                | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
+| `<prefix>.frontend.redirect.replacement=http://mydomain/$1`              | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
+| `<prefix>.frontend.redirect.permanent=true`                              | Returns 301 instead of 302.                                                                                                                                                                                                   |
+| `<prefix>.frontend.rule=EXPR`                                            | Overrides the default frontend rule. Default: `Host:{{.ServiceName}}.{{.Domain}}`.                                                                                                                                            |
+| `<prefix>.frontend.whiteList.sourceRange=RANGE`                          | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `<prefix>.frontend.whiteList.useXForwardedFor=true`                      | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |

 ### Multiple frontends for a single service

--- a/docs/configuration/backends/docker.md
+++ b/docs/configuration/backends/docker.md
@@ -57,7 +57,7 @@ watch = true
 exposedByDefault = true

 # Use the IP address from the binded port instead of the inner network one.
-# 
+#
 # In case no IP address is attached to the binded port (or in case 
 # there is no bind), the inner network one will be used as a fallback.     
 #
@@ -73,6 +73,13 @@ usebindportip = true
 #
 swarmMode = false

+# Polling interval (in seconds) for Swarm Mode.
+#
+# Optional
+# Default: 15
+#
+swarmModeRefreshSeconds = 15
+
 # Define a default docker network to use for connections to all containers.
 # Can be overridden by the traefik.docker.network label.
 #
@@ -93,7 +100,6 @@ network = "web"

 To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific).

-
 ## Docker Swarm Mode

 ```toml
@@ -110,7 +116,10 @@ To enable constraints see [provider-specific constraints section](/configuration
 # Required
 # Default: "unix:///var/run/docker.sock"
 #
-endpoint = "tcp://127.0.0.1:2375"
+# swarm classic (1.12-)
+# endpoint = "tcp://127.0.0.1:2375"
+# docker swarm mode (1.12+)
+endpoint = "tcp://127.0.0.1:2377"

 # Default base domain used for the frontend rules.
 # Can be overridden by setting the "traefik.domain" label on a services.
@@ -177,6 +186,57 @@ exposedByDefault = false

 To enable constraints see [provider-specific constraints section](/configuration/commons/#provider-specific).

+## Security Considerations
+
+### Security Challenge with the Docker Socket
+
+Traefik requires access to the docker socket to get its dynamic configuration,
+by watching the Docker API through this socket.
+
+!!! important
+    Depending on your context and your usage, accessing the Docker API without any restriction might be a security concern.
+
+As explained on the Docker documentation: ([Docker Daemon Attack Surface page](https://docs.docker.com/engine/security/security/#docker-daemon-attack-surface)):
+
+`[...] only **trusted** users should be allowed to control your Docker daemon [...]`
+
+If the Traefik processes (handling requests from the outside world) is attacked,
+then the attacker can access the Docker (or Swarm Mode) backend.
+
+Also, when using Swarm Mode, it is mandatory to schedule Traefik's containers on the Swarm manager nodes,
+to let Traefik accessing the Docker Socket of the Swarm manager node.
+
+More information about Docker's security:
+
+- [KubeCon EU 2018 Keynote, Running with Scissors, from Liz Rice](https://www.youtube.com/watch?v=ltrV-Qmh3oY)
+- [Don't expose the Docker socket (not even to a container)](https://www.lvh.io/posts/dont-expose-the-docker-socket-not-even-to-a-container.html)
+- [A thread on Stack Overflow about sharing the `/var/run/docker.sock` file](https://news.ycombinator.com/item?id=17983623)
+- [To Dind or not to DinD](https://blog.loof.fr/2018/01/to-dind-or-not-do-dind.html)
+
+### Security Compensation
+
+The main security compensation is to expose the Docker socket over TCP, instead of the default Unix socket file.
+It allows different implementation levels of the [AAA (Authentication, Authorization, Accounting) concepts](https://en.wikipedia.org/wiki/AAA_(computer_security)), depending on your security assessment:
+
+- Authentication with Client Certificates as described in [the "Protect the Docker daemon socket" page of Docker's documentation](https://docs.docker.com/engine/security/https/)
+
+- Authorization with the [Docker Authorization Plugin Mechanism](https://docs.docker.com/engine/extend/plugins_authorization/)
+
+- Accounting at networking level, by exposing the socket only inside a Docker private network, only available for Traefik.
+
+- Accounting at container level, by exposing the socket on a another container than Traefik's.
+  With Swarm mode, it allows scheduling of Traefik on worker nodes, with only the "socket exposer" container on the manager nodes.
+
+- Accounting at kernel level, by enforcing kernel calls with mechanisms like [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux),
+  to only allows an identified set of actions for Traefik's process (or the "socket exposer" process).
+
+Use the following ressources to get started:
+
+- [Traefik issue GH-4174 about security with Docker socket](https://github.com/containous/traefik/issues/4174)
+- [Inspecting Docker Activity with Socat](https://developers.redhat.com/blog/2015/02/25/inspecting-docker-activity-with-socat/)
+- [Letting Traefik run on Worker Nodes](https://blog.mikesir87.io/2018/07/letting-traefik-run-on-worker-nodes/)
+- [Docker Socket Proxy from Tecnativa](https://github.com/Tecnativa/docker-socket-proxy)
+
 ## Labels: overriding default behavior

 ### Using Docker with Swarm Mode
@@ -209,97 +269,109 @@ services:

 Labels can be used on containers to override default behavior.

-| Label                                                               | Description                                                                                                                                                                                                                      |
-|---------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.docker.network`                                            | Overrides the default docker network to use for connections to the container. [1]                                                                                                                                                |
-| `traefik.domain`                                                    | Sets the default base domain for the frontend rules. For more information, check the [Container Labels section's of the user guide "Let's Encrypt & Docker"](/user-guide/docker-and-lets-encrypt/#container-labels)              |
-| `traefik.enable=false`                                              | Disables this container in Traefik.                                                                                                                                                                                              |
-| `traefik.port=80`                                                   | Registers this port. Useful when the container exposes multiples ports.                                                                                                                                                          |
-| `traefik.tags=foo,bar,myTag`                                        | Adds Traefik tags to the Docker container/service to be used in [constraints](/configuration/commons/#constraints).                                                                                                              |
-| `traefik.protocol=https`                                            | Overrides the default `http` protocol                                                                                                                                                                                            |
-| `traefik.weight=10`                                                 | Assigns this weight to the container                                                                                                                                                                                             |
-| `traefik.backend=foo`                                               | Gives the name `foo` to the generated backend for this container.                                                                                                                                                                |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.memRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.memResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.retryExpression=EXPR`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.circuitbreaker.expression=EXPR`                    | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                    |
-| `traefik.backend.responseForwarding.flushInterval=10ms`             | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                        |
-| `traefik.backend.healthcheck.path=/health`                          | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                           |
-| `traefik.backend.healthcheck.interval=1s`                           | Defines the health check interval.                                                                                                                                                                                               |
-| `traefik.backend.healthcheck.port=8080`                             | Sets a different port for the health check.                                                                                                                                                                                      |
-| `traefik.backend.healthcheck.scheme=http`                           | Overrides the server URL scheme.                                                                                                                                                                                                 |
-| `traefik.backend.healthcheck.hostname=foobar.com`                   | Defines the health check hostname.                                                                                                                                                                                               |
-| `traefik.backend.healthcheck.headers=EXPR`                          | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                        |
-| `traefik.backend.loadbalancer.method=drr`                           | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                              |
-| `traefik.backend.loadbalancer.stickiness=true`                      | Enables backend sticky sessions                                                                                                                                                                                                  |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`           | Sets the cookie name manually for sticky sessions                                                                                                                                                                                |
-| `traefik.backend.loadbalancer.sticky=true`                          | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                     |
-| `traefik.backend.loadbalancer.swarm=true`                           | Uses Swarm's inbuilt load balancer (only relevant under Swarm Mode).                                                                                                                                                             |
-| `traefik.backend.maxconn.amount=10`                                 | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                         |
-| `traefik.backend.maxconn.extractorfunc=client.ip`                   | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                           |
-| `traefik.frontend.auth.basic=EXPR`                                  | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` [2] (DEPRECATED).                                                                                                                            |
-| `traefik.frontend.auth.basic.removeHeader=true`                     | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
-| `traefik.frontend.auth.basic.users=EXPR`                            | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` [2].                                                                                                                                         |
-| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`             | Sets the basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
-| `traefik.frontend.auth.digest.removeHeader=true`                    | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
-| `traefik.frontend.auth.digest.users=EXPR`                           | Sets the digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                |
-| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`            | Sets the digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                       |
-| `traefik.frontend.auth.forward.address=https://example.com`         | Sets the URL of the authentication server.                                                                                                                                                                                       |
-| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`            | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                       |
-| `traefik.frontend.auth.forward.tls.caOptional=true`                 | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                      |
-| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`           | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
-| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`         | If set to true invalid SSL certificates are accepted.                                                                                                                                                                            |
-| `traefik.frontend.auth.forward.tls.key=/path/server.key`            | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
-| `traefik.frontend.auth.forward.trustForwardHeader=true`             | Trusts X-Forwarded-* headers.                                                                                                                                                                                                    |
-| `traefik.frontend.auth.headerField=X-WebAuth-User`                  | Sets the header user to pass the authenticated user to the application.                                                                                                                                                          |
-| `traefik.frontend.entryPoints=http,https`                           | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                      |
-| `traefik.frontend.errors.<name>.backend=NAME`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
-| `traefik.frontend.errors.<name>.query=PATH`                         | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
-| `traefik.frontend.errors.<name>.status=RANGE`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
-| `traefik.frontend.passHostHeader=true`                              | Forwards client `Host` header to the backend.                                                                                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.notAfter=true`            | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.notBefore=true`           | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                              |
-| `traefik.frontend.passTLSClientCert.infos.sans=true`                | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                                  |
-| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`  | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.subject.country=true`     | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
-| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`    | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
-| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
-| `traefik.frontend.passTLSClientCert.infos.subject.province=true`    | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
-| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
-| `traefik.frontend.passTLSClientCert.pem=true`                       | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                                |
-| `traefik.frontend.passTLSCert=true`                                 | Forwards TLS Client certificates to the backend (DEPRECATED).                                                                                                                                                                    |
-| `traefik.frontend.priority=10`                                      | Overrides default frontend priority                                                                                                                                                                                              |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`                      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`               | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                 | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.redirect.entryPoint=https`                        | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                             |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`            | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                          |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1`          | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                                |
-| `traefik.frontend.redirect.permanent=true`                          | Returns 301 instead of 302.                                                                                                                                                                                                      |
-| `traefik.frontend.rule=EXPR`                                        | Overrides the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                                     |
-| `traefik.frontend.whiteList.sourceRange=RANGE`                      | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`                  | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                          |
+| Label                                                                   | Description                                                                                                                                                                                                                      |
+|-------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.docker.network`                                                | Overrides the default docker network to use for connections to the container. [1]                                                                                                                                                |
+| `traefik.domain`                                                        | Sets the default base domain for the frontend rules. For more information, check the [Container Labels section's of the user guide "Let's Encrypt & Docker"](/user-guide/docker-and-lets-encrypt/#container-labels)              |
+| `traefik.enable=false`                                                  | Disables this container in Traefik.                                                                                                                                                                                              |
+| `traefik.port=80`                                                       | Registers this port. Useful when the container exposes multiples ports.                                                                                                                                                          |
+| `traefik.tags=foo,bar,myTag`                                            | Adds Traefik tags to the Docker container/service to be used in [constraints](/configuration/commons/#constraints).                                                                                                              |
+| `traefik.protocol=https`                                                | Overrides the default `http` protocol                                                                                                                                                                                            |
+| `traefik.weight=10`                                                     | Assigns this weight to the container                                                                                                                                                                                             |
+| `traefik.backend=foo`                                                   | Overrides the container name by `foo` in the generated name of the backend.                                                                                                                                                      |
+| `traefik.backend.buffering.maxRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.maxResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.memRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.memResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.retryExpression=EXPR`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.circuitbreaker.expression=EXPR`                        | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                    |
+| `traefik.backend.responseForwarding.flushInterval=10ms`                 | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                        |
+| `traefik.backend.healthcheck.path=/health`                              | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                           |
+| `traefik.backend.healthcheck.interval=1s`                               | Defines the health check interval.                                                                                                                                                                                               |
+| `traefik.backend.healthcheck.port=8080`                                 | Sets a different port for the health check.                                                                                                                                                                                      |
+| `traefik.backend.healthcheck.scheme=http`                               | Overrides the server URL scheme.                                                                                                                                                                                                 |
+| `traefik.backend.healthcheck.hostname=foobar.com`                       | Defines the health check hostname.                                                                                                                                                                                               |
+| `traefik.backend.healthcheck.headers=EXPR`                              | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                        |
+| `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                              |
+| `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                                  |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                     |
+| `traefik.backend.loadbalancer.swarm=true`                               | Uses Swarm's inbuilt load balancer (only relevant under Swarm Mode) [3].                                                                                                                                                         |
+| `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                         |
+| `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                           |
+| `traefik.frontend.auth.basic=EXPR`                                      | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` [2] (DEPRECATED).                                                                                                                            |
+| `traefik.frontend.auth.basic.removeHeader=true`                         | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
+| `traefik.frontend.auth.basic.users=EXPR`                                | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` [2].                                                                                                                                         |
+| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Sets the basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
+| `traefik.frontend.auth.digest.removeHeader=true`                        | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
+| `traefik.frontend.auth.digest.users=EXPR`                               | Sets the digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                |
+| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`                | Sets the digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                       |
+| `traefik.frontend.auth.forward.address=https://example.com`             | Sets the URL of the authentication server.                                                                                                                                                                                       |
+| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`                | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                       |
+| `traefik.frontend.auth.forward.tls.caOptional=true`                     | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                      |
+| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`               | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
+| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`             | If set to true invalid SSL certificates are accepted.                                                                                                                                                                            |
+| `traefik.frontend.auth.forward.tls.key=/path/server.key`                | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
+| `traefik.frontend.auth.forward.trustForwardHeader=true`                 | Trusts X-Forwarded-* headers.                                                                                                                                                                                                    |
+| `traefik.frontend.auth.headerField=X-WebAuth-User`                      | Sets the header user to pass the authenticated user to the application.                                                                                                                                                          |
+| `traefik.frontend.entryPoints=http,https`                               | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                      |
+| `traefik.frontend.errors.<name>.backend=NAME`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
+| `traefik.frontend.errors.<name>.query=PATH`                             | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
+| `traefik.frontend.errors.<name>.status=RANGE`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
+| `traefik.frontend.passHostHeader=true`                                  | Forwards client `Host` header to the backend.                                                                                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                     |
+| `traefik.frontend.passTLSClientCert.infos.issuer.country=true`          | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                        |
+| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true`         | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
+| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true`     | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.issuer.province=true`         | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
+| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.notAfter=true`                | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.notBefore=true`               | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                              |
+| `traefik.frontend.passTLSClientCert.infos.sans=true`                    | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`      | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.subject.country=true`         | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
+| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`        | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
+| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`    | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.subject.province=true`        | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
+| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.pem=true`                           | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                                |
+| `traefik.frontend.passTLSCert=true`                                     | Forwards TLS Client certificates to the backend (DEPRECATED).                                                                                                                                                                    |
+| `traefik.frontend.priority=10`                                          | Overrides default frontend priority                                                                                                                                                                                              |
+| `traefik.frontend.rateLimit.extractorFunc=EXP`                          | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                    | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.rateLimit.rateSet.<name>.average=6`                   | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                     | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.redirect.entryPoint=https`                            | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                             |
+| `traefik.frontend.redirect.regex=^http://localhost/(.*)`                | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                          |
+| `traefik.frontend.redirect.replacement=http://mydomain/$1`              | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                                |
+| `traefik.frontend.redirect.permanent=true`                              | Returns 301 instead of 302.                                                                                                                                                                                                      |
+| `traefik.frontend.rule=EXPR`                                            | Overrides the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                                     |
+| `traefik.frontend.whiteList.sourceRange=RANGE`                          | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.frontend.whiteList.useXForwardedFor=true`                      | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                          |

-[1] `traefik.docker.network`:
-If a container is linked to several networks, be sure to set the proper network name (you can check with `docker inspect <container_id>`) otherwise it will randomly pick one (depending on how docker is returning them).
+[1] `traefik.docker.network`:  
+If a container is linked to several networks, be sure to set the proper network name (you can check with `docker inspect <container_id>`) otherwise it will randomly pick one (depending on how docker is returning them).  
 For instance when deploying docker `stack` from compose files, the compose defined networks will be prefixed with the `stack` name.
 Or if your service references external network use it's name instead.

-[2] `traefik.frontend.auth.basic.users=EXPR `:  
+[2] `traefik.frontend.auth.basic.users=EXPR`:  
 To create `user:password` pair, it's possible to use this command:  
 `echo $(htpasswd -nb user password) | sed -e s/\\$/\\$\\$/g`.  
 The result will be `user:$$apr1$$9Cv/OMGj$$ZomWQzuQbL.3TRCS81A1g/`, note additional symbol `$` makes escaping.

+[3] `traefik.backend.loadbalancer.swarm`:  
+If you enable this option, Traefik will use the virtual IP provided by docker swarm instead of the containers IPs.
+Which means that Traefik will not perform any kind of load balancing and will delegate this task to swarm.  
+It also means that Traefik will manipulate only one backend, not one backend per container.

 #### Custom Headers

 | Label                                                 | Description                                                                                                                                                                         |
 |-------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.frontend.headers.customRequestHeaders=EXPR ` | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
+| `traefik.frontend.headers.customRequestHeaders=EXPR`  | Provides the container with custom request headers that will be appended to each request forwarded to the container.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code> |
 | `traefik.frontend.headers.customResponseHeaders=EXPR` | Appends the headers to each response returned by the container, before forwarding the response to the client.<br>Format: <code>HEADER:value&vert;&vert;HEADER2:value2</code>        |

 #### Security Headers
@@ -314,7 +386,7 @@ The result will be `user:$$apr1$$9Cv/OMGj$$ZomWQzuQbL.3TRCS81A1g/`, note additio
 | `traefik.frontend.headers.customFrameOptionsValue=VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
 | `traefik.frontend.headers.forceSTSHeader=false`          | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
 | `traefik.frontend.headers.frameDeny=false`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
-| `traefik.frontend.headers.hostsProxyHeaders=EXPR `       | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
+| `traefik.frontend.headers.hostsProxyHeaders=EXPR`        | Provides a list of headers that the proxied hostname may be stored.<br>Format: `HEADER1,HEADER2`                                                                                                    |
 | `traefik.frontend.headers.isDevelopment=false`           | This will cause the `AllowedHosts`, `SSLRedirect`, and `STSSeconds`/`STSIncludeSubdomains` options to be ignored during development.<br>When deploying to production, be sure to set this to false. |
 | `traefik.frontend.headers.publicKey=VALUE`               | Adds HPKP header.                                                                                                                                                                                   |
 | `traefik.frontend.headers.referrerPolicy=VALUE`          | Adds referrer policy  header.                                                                                                                                                                       |
@@ -335,63 +407,71 @@ You can define as many segments as ports exposed in a container.

 Segment labels override the default behavior.

-| Label                                                                              | Description                                                            |
-|------------------------------------------------------------------------------------|------------------------------------------------------------------------|
-| `traefik.<segment_name>.backend=BACKEND`                                           | Same as `traefik.backend`                                              |
-| `traefik.<segment_name>.domain=DOMAIN`                                             | Same as `traefik.domain`                                               |
-| `traefik.<segment_name>.port=PORT`                                                 | Same as `traefik.port`                                                 |
-| `traefik.<segment_name>.protocol=http`                                             | Same as `traefik.protocol`                                             |
-| `traefik.<segment_name>.weight=10`                                                 | Same as `traefik.weight`                                               |
-| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                  | Same as `traefik.frontend.auth.basic`                                  |
-| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                     | Same as `traefik.frontend.auth.basic.removeHeader`                     |
-| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                            | Same as `traefik.frontend.auth.basic.users`                            |
-| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`             | Same as `traefik.frontend.auth.basic.usersFile`                        |
-| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                    | Same as `traefik.frontend.auth.digest.removeHeader`                    |
-| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                           | Same as `traefik.frontend.auth.digest.users`                           |
-| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`            | Same as `traefik.frontend.auth.digest.usersFile`                       |
-| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`         | Same as `traefik.frontend.auth.forward.address`                        |
-| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`            | Same as `traefik.frontend.auth.forward.authResponseHeaders`            |
-| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Same as `traefik.frontend.auth.forward.tls.ca`                         |
-| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                 | Same as `traefik.frontend.auth.forward.tls.caOptional`                 |
-| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`           | Same as `traefik.frontend.auth.forward.tls.cert`                       |
-| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`         | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`         |
-| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`            | Same as `traefik.frontend.auth.forward.tls.key`                        |
-| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`             | Same as `traefik.frontend.auth.forward.trustForwardHeader`             |
-| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                  | Same as `traefik.frontend.auth.headerField`                            |
-| `traefik.<segment_name>.frontend.entryPoints=https`                                | Same as `traefik.frontend.entryPoints`                                 |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                       | Same as `traefik.frontend.errors.<name>.backend`                       |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                         | Same as `traefik.frontend.errors.<name>.query`                         |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                       | Same as `traefik.frontend.errors.<name>.status`                        |
-| `traefik.<segment_name>.frontend.passHostHeader=true`                              | Same as `traefik.frontend.passHostHeader`                              |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`            | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`            |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`           | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`           |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                | Same as `traefik.frontend.passTLSClientCert.infos.sans`                |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`  | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`  |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`     | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`     |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`    |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`|
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`    |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`|
-| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                       | Same as `traefik.frontend.passTLSClientCert.infos.pem`                 |
-| `traefik.<segment_name>.frontend.passTLSCert=true`                                 | Same as `traefik.frontend.passTLSCert`                                 |
-| `traefik.<segment_name>.frontend.priority=10`                                      | Same as `traefik.frontend.priority`                                    |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                      | Same as `traefik.frontend.rateLimit.extractorFunc`                     |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`             |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`               | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`            |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                 | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                        | Same as `traefik.frontend.redirect.entryPoint`                         |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`            | Same as `traefik.frontend.redirect.regex`                              |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`          | Same as `traefik.frontend.redirect.replacement`                        |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                          | Same as `traefik.frontend.redirect.permanent`                          |
-| `traefik.<segment_name>.frontend.rule=EXP`                                         | Same as `traefik.frontend.rule`                                        |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                      | Same as `traefik.frontend.whiteList.sourceRange`                       |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                  | Same as `traefik.frontend.whiteList.useXForwardedFor`                  |
+| Label                                                                                  | Description                                                                |
+|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------|
+| `traefik.<segment_name>.backend=BACKEND`                                               | Same as `traefik.backend`                                                  |
+| `traefik.<segment_name>.domain=DOMAIN`                                                 | Same as `traefik.domain`                                                   |
+| `traefik.<segment_name>.port=PORT`                                                     | Same as `traefik.port`                                                     |
+| `traefik.<segment_name>.protocol=http`                                                 | Same as `traefik.protocol`                                                 |
+| `traefik.<segment_name>.weight=10`                                                     | Same as `traefik.weight`                                                   |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                      | Same as `traefik.frontend.auth.basic`                                      |
+| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                         | Same as `traefik.frontend.auth.basic.removeHeader`                         |
+| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                                | Same as `traefik.frontend.auth.basic.users`                                |
+| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Same as `traefik.frontend.auth.basic.usersFile`                            |
+| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                        | Same as `traefik.frontend.auth.digest.removeHeader`                        |
+| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                               | Same as `traefik.frontend.auth.digest.users`                               |
+| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`                | Same as `traefik.frontend.auth.digest.usersFile`                           |
+| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`             | Same as `traefik.frontend.auth.forward.address`                            |
+| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`                | Same as `traefik.frontend.auth.forward.authResponseHeaders`                |
+| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Same as `traefik.frontend.auth.forward.tls.ca`                             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                     | Same as `traefik.frontend.auth.forward.tls.caOptional`                     |
+| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`               | Same as `traefik.frontend.auth.forward.tls.cert`                           |
+| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`             | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`                | Same as `traefik.frontend.auth.forward.tls.key`                            |
+| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`                 | Same as `traefik.frontend.auth.forward.trustForwardHeader`                 |
+| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                      | Same as `traefik.frontend.auth.headerField`                                |
+| `traefik.<segment_name>.frontend.entryPoints=https`                                    | Same as `traefik.frontend.entryPoints`                                     |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                           | Same as `traefik.frontend.errors.<name>.backend`                           |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                             | Same as `traefik.frontend.errors.<name>.query`                             |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                           | Same as `traefik.frontend.errors.<name>.status`                            |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                                  | Same as `traefik.frontend.passHostHeader`                                  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName`       |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.country=true`          | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country`          |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent`  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.locality=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.organization=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.province=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`                | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`                |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`               | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`               |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                    | Same as `traefik.frontend.passTLSClientCert.infos.sans`                    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`      | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`      |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`         | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                           | Same as `traefik.frontend.passTLSClientCert.infos.pem`                     |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                                     | Same as `traefik.frontend.passTLSCert`                                     |
+| `traefik.<segment_name>.frontend.priority=10`                                          | Same as `traefik.frontend.priority`                                        |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                          | Same as `traefik.frontend.rateLimit.extractorFunc`                         |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                    | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`                 |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`                   | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`                |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                     | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`                  |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                            | Same as `traefik.frontend.redirect.entryPoint`                             |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`                | Same as `traefik.frontend.redirect.regex`                                  |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`              | Same as `traefik.frontend.redirect.replacement`                            |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                              | Same as `traefik.frontend.redirect.permanent`                              |
+| `traefik.<segment_name>.frontend.rule=EXP`                                             | Same as `traefik.frontend.rule`                                            |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                          | Same as `traefik.frontend.whiteList.sourceRange`                           |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                      | Same as `traefik.frontend.whiteList.useXForwardedFor`                      |

 #### Custom Headers

 | Label                                                                | Description                                              |
 |----------------------------------------------------------------------|----------------------------------------------------------|
-| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR ` | Same as `traefik.frontend.headers.customRequestHeaders`  |
+| `traefik.<segment_name>.frontend.headers.customRequestHeaders=EXPR`  | Same as `traefik.frontend.headers.customRequestHeaders`  |
 | `traefik.<segment_name>.frontend.headers.customResponseHeaders=EXPR` | Same as `traefik.frontend.headers.customResponseHeaders` |

 #### Security Headers
--- a/docs/configuration/backends/ecs.md
+++ b/docs/configuration/backends/ecs.md
@@ -136,78 +136,86 @@ Traefik needs the following policy to read ECS information:

 Labels can be used on task containers to override default behaviour:

-| Label                                                               | Description                                                                                                                                                                                                                   |
-|---------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.domain`                                                    | Sets the default base domain for frontend rules.                                                                                                                                                                                   |
-| `traefik.enable=false`                                              | Disables this container in Traefik.                                                                                                                                                                                            |
-| `traefik.port=80`                                                   | Overrides the default `port` value. Overrides `NetworkBindings` from Docker Container                                                                                                                                         |
-| `traefik.protocol=https`                                            | Overrides the default `http` protocol                                                                                                                                                                                         |
-| `traefik.weight=10`                                                 | Assigns this weight to the container                                                                                                                                                                                          |
-| `traefik.backend=foo`                                               | Gives the name `foo` to the generated backend for this container.                                                                                                                                                             |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.retryExpression=EXPR`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.circuitbreaker.expression=EXPR`                    | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                 |
-| `traefik.backend.responseForwarding.flushInterval=10ms`            | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
-| `traefik.backend.healthcheck.path=/health`                          | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
-| `traefik.backend.healthcheck.interval=1s`                           | Defines the health check interval. (Default: 30s)                                                                                                                                                                             |
-| `traefik.backend.healthcheck.scheme=http`                           | Overrides the server URL scheme.                                                                                                                                                                                              |
-| `traefik.backend.healthcheck.port=8080`                             | Sets a different port for the health check.                                                                                                                                                                                   |
-| `traefik.backend.healthcheck.hostname=foobar.com`                   | Defines the health check hostname.                                                                                                                                                                                            |
-| `traefik.backend.healthcheck.headers=EXPR`                          | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
-| `traefik.backend.loadbalancer.method=drr`                           | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
-| `traefik.backend.loadbalancer.stickiness=true`                      | Enables backend sticky sessions                                                                                                                                                                                               |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`           | Sets the cookie manually  name for sticky sessions                                                                                                                                                                            |
-| `traefik.backend.loadbalancer.sticky=true`                          | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                  |
-| `traefik.backend.maxconn.amount=10`                                 | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
-| `traefik.backend.maxconn.extractorfunc=client.ip`                   | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
-| `traefik.frontend.auth.basic=EXPR`                                  | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
-| `traefik.frontend.auth.basic.removeHeader=true`                     | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `traefik.frontend.auth.basic.users=EXPR`                            | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
-| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`             | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
-| `traefik.frontend.auth.digest.removeHeader=true`                    | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `traefik.frontend.auth.digest.users=EXPR`                           | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
-| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`            | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
-| `traefik.frontend.auth.forward.address=https://example.com`         | Sets the URL of the authentication server.                                                                                                                                                                                    |
-| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`            | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
-| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
-| `traefik.frontend.auth.forward.tls.caOptional=true`                 | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`           | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`         | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
-| `traefik.frontend.auth.forward.tls.key=/path/server.key`            | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `traefik.frontend.auth.forward.trustForwardHeader=true`             | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
-| `traefik.frontend.auth.headerField=X-WebAuth-User`                  | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
-| `traefik.frontend.auth.removeHeader=true`                           | If set to true, removes the Authorization header.                                                                                                                                                                             |
-| `traefik.frontend.passTLSClientCert.infos.notAfter=true`            | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
-| `traefik.frontend.passTLSClientCert.infos.notBefore=true`           | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
-| `traefik.frontend.passTLSClientCert.infos.sans=true`                | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`  | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
-| `traefik.frontend.passTLSClientCert.infos.subject.country=true`     | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`    | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.subject.province=true`    | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `traefik.frontend.passTLSClientCert.pem=true`                       | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                           |
-| `traefik.frontend.entryPoints=http,https`                           | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                               |
-| `traefik.frontend.errors.<name>.backend=NAME`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.errors.<name>.query=PATH`                         | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.errors.<name>.status=RANGE`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.passHostHeader=true`                              | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
-| `traefik.frontend.passTLSCert=true`                                 | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
-| `traefik.frontend.priority=10`                                      | Overrides default frontend priority                                                                                                                                                                                           |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`                      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`               | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                 | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.redirect.entryPoint=https`                        | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                          |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`            | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1`          | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
-| `traefik.frontend.redirect.permanent=true`                          | Returns 301 instead of 302.                                                                                                                                                                                                   |
-| `traefik.frontend.rule=EXPR`                                        | Overrides the default frontend rule. Default: `Host:{instance_name}.{domain}`.                                                                                                                                                |
-| `traefik.frontend.whiteList.sourceRange=RANGE`                      | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`                  | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |
+| Label                                                                   | Description                                                                                                                                                                                                                   |
+|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                                        | Sets the default base domain for frontend rules.                                                                                                                                                                              |
+| `traefik.enable=false`                                                  | Disables this container in Traefik.                                                                                                                                                                                           |
+| `traefik.port=80`                                                       | Overrides the default `port` value. Overrides `NetworkBindings` from Docker Container                                                                                                                                         |
+| `traefik.protocol=https`                                                | Overrides the default `http` protocol                                                                                                                                                                                         |
+| `traefik.weight=10`                                                     | Assigns this weight to the container                                                                                                                                                                                          |
+| `traefik.backend=foo`                                                   | Overrides the service name by `foo` in the generated name of the backend.                                                                                                                                                     |
+| `traefik.backend.buffering.maxRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.maxResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.retryExpression=EXPR`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.circuitbreaker.expression=EXPR`                        | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                 |
+| `traefik.backend.responseForwarding.flushInterval=10ms`                 | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
+| `traefik.backend.healthcheck.path=/health`                              | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
+| `traefik.backend.healthcheck.interval=1s`                               | Defines the health check interval. (Default: 30s)                                                                                                                                                                             |
+| `traefik.backend.healthcheck.scheme=http`                               | Overrides the server URL scheme.                                                                                                                                                                                              |
+| `traefik.backend.healthcheck.port=8080`                                 | Sets a different port for the health check.                                                                                                                                                                                   |
+| `traefik.backend.healthcheck.hostname=foobar.com`                       | Defines the health check hostname.                                                                                                                                                                                            |
+| `traefik.backend.healthcheck.headers=EXPR`                              | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
+| `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
+| `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                               |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie manually  name for sticky sessions                                                                                                                                                                            |
+| `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                  |
+| `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
+| `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
+| `traefik.frontend.auth.basic=EXPR`                                      | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
+| `traefik.frontend.auth.basic.removeHeader=true`                         | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `traefik.frontend.auth.basic.users=EXPR`                                | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
+| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
+| `traefik.frontend.auth.digest.removeHeader=true`                        | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `traefik.frontend.auth.digest.users=EXPR`                               | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
+| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`                | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
+| `traefik.frontend.auth.forward.address=https://example.com`             | Sets the URL of the authentication server.                                                                                                                                                                                    |
+| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`                | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
+| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
+| `traefik.frontend.auth.forward.tls.caOptional=true`                     | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`               | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`             | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
+| `traefik.frontend.auth.forward.tls.key=/path/server.key`                | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `traefik.frontend.auth.forward.trustForwardHeader=true`                 | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
+| `traefik.frontend.auth.headerField=X-WebAuth-User`                      | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
+| `traefik.frontend.auth.removeHeader=true`                               | If set to true, removes the Authorization header.                                                                                                                                                                             |
+| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.issuer.country=true`          | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                     |
+| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                            |
+| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true`         | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true`     | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.issuer.province=true`         | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.notAfter=true`                | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
+| `traefik.frontend.passTLSClientCert.infos.notBefore=true`               | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
+| `traefik.frontend.passTLSClientCert.infos.sans=true`                    | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`      | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
+| `traefik.frontend.passTLSClientCert.infos.subject.country=true`         | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                           |
+| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`        | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`    | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.province=true`        | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.pem=true`                           | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
+| `traefik.frontend.entryPoints=http,https`                               | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
+| `traefik.frontend.errors.<name>.backend=NAME`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.errors.<name>.query=PATH`                             | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.errors.<name>.status=RANGE`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.passHostHeader=true`                                  | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
+| `traefik.frontend.passTLSCert=true`                                     | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
+| `traefik.frontend.priority=10`                                          | Overrides default frontend priority                                                                                                                                                                                           |
+| `traefik.frontend.rateLimit.extractorFunc=EXP`                          | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                    | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.average=6`                   | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                     | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.redirect.entryPoint=https`                            | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                          |
+| `traefik.frontend.redirect.regex=^http://localhost/(.*)`                | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
+| `traefik.frontend.redirect.replacement=http://mydomain/$1`              | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
+| `traefik.frontend.redirect.permanent=true`                              | Returns 301 instead of 302.                                                                                                                                                                                                   |
+| `traefik.frontend.rule=EXPR`                                            | Overrides the default frontend rule. Default: `Host:{instance_name}.{domain}`.                                                                                                                                                |
+| `traefik.frontend.whiteList.sourceRange=RANGE`                          | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.frontend.whiteList.useXForwardedFor=true`                      | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |

 ### Custom Headers

@@ -249,58 +257,66 @@ You can define as many segments as ports exposed in an application.

 Segment labels override the default behavior.

-| Label                                                                               | Description                                                             |
-|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------|
-| `traefik.<segment_name>.backend=BACKEND`                                            | Same as `traefik.backend`                                               |
-| `traefik.<segment_name>.domain=DOMAIN`                                              | Same as `traefik.domain`                                                |
-| `traefik.<segment_name>.port=PORT`                                                  | Same as `traefik.port`                                                  |
-| `traefik.<segment_name>.protocol=http`                                              | Same as `traefik.protocol`                                              |
-| `traefik.<segment_name>.weight=10`                                                  | Same as `traefik.weight`                                                |
-| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                   | Same as `traefik.frontend.auth.basic`                                   |
-| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                      | Same as `traefik.frontend.auth.basic.removeHeader`                      |
-| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                             | Same as `traefik.frontend.auth.basic.users`                             |
-| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`              | Same as `traefik.frontend.auth.basic.usersFile`                         |
-| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                     | Same as `traefik.frontend.auth.digest.removeHeader`                     |
-| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                            | Same as `traefik.frontend.auth.digest.users`                            |
-| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`             | Same as `traefik.frontend.auth.digest.usersFile`                        |
-| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`          | Same as `traefik.frontend.auth.forward.address`                         |
-| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`             | Same as `traefik.frontend.auth.forward.authResponseHeaders`             |
-| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                  | Same as `traefik.frontend.auth.forward.tls.ca`                          |
-| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                  | Same as `traefik.frontend.auth.forward.tls.caOptional`                  |
-| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`            | Same as `traefik.frontend.auth.forward.tls.cert`                        |
-| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`          | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`          |
-| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`             | Same as `traefik.frontend.auth.forward.tls.key`                         |
-| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`              | Same as `traefik.frontend.auth.forward.trustForwardHeader`              |
-| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                   | Same as `traefik.frontend.auth.headerField`                             |
-| `traefik.<segment_name>.frontend.auth.removeHeader=true`                            | Same as `traefik.frontend.auth.removeHeader`                            |
-| `traefik.<segment_name>.frontend.entryPoints=https`                                 | Same as `traefik.frontend.entryPoints`                                  |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                        | Same as `traefik.frontend.errors.<name>.backend`                        |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                          | Same as `traefik.frontend.errors.<name>.query`                          |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                        | Same as `traefik.frontend.errors.<name>.status`                         |
-| `traefik.<segment_name>.frontend.passHostHeader=true`                               | Same as `traefik.frontend.passHostHeader`                               |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`             | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`             |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`            | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`            |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                 | Same as `traefik.frontend.passTLSClientCert.infos.sans`                 |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`   | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`   |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`      | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`      |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`     | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`     |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization` |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`     | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`     |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber` |
-| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                        | Same as `traefik.frontend.passTLSClientCert.infos.pem`                  |
-| `traefik.<segment_name>.frontend.passTLSCert=true`                                  | Same as `traefik.frontend.passTLSCert`                                  |
-| `traefik.<segment_name>.frontend.priority=10`                                       | Same as `traefik.frontend.priority`                                     |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                       | Same as `traefik.frontend.rateLimit.extractorFunc`                      |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                 | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`              |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`                | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`             |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                  | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`               |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                         | Same as `traefik.frontend.redirect.entryPoint`                          |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`             | Same as `traefik.frontend.redirect.regex`                               |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`           | Same as `traefik.frontend.redirect.replacement`                         |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                           | Same as `traefik.frontend.redirect.permanent`                           |
-| `traefik.<segment_name>.frontend.rule=EXP`                                          | Same as `traefik.frontend.rule`                                         |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                       | Same as `traefik.frontend.whiteList.sourceRange`                        |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                   | Same as `traefik.frontend.whiteList.useXForwardedFor`                   |
+| Label                                                                                  | Description                                                                |
+|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------|
+| `traefik.<segment_name>.backend=BACKEND`                                               | Same as `traefik.backend`                                                  |
+| `traefik.<segment_name>.domain=DOMAIN`                                                 | Same as `traefik.domain`                                                   |
+| `traefik.<segment_name>.port=PORT`                                                     | Same as `traefik.port`                                                     |
+| `traefik.<segment_name>.protocol=http`                                                 | Same as `traefik.protocol`                                                 |
+| `traefik.<segment_name>.weight=10`                                                     | Same as `traefik.weight`                                                   |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                      | Same as `traefik.frontend.auth.basic`                                      |
+| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                         | Same as `traefik.frontend.auth.basic.removeHeader`                         |
+| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                                | Same as `traefik.frontend.auth.basic.users`                                |
+| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Same as `traefik.frontend.auth.basic.usersFile`                            |
+| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                        | Same as `traefik.frontend.auth.digest.removeHeader`                        |
+| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                               | Same as `traefik.frontend.auth.digest.users`                               |
+| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`                | Same as `traefik.frontend.auth.digest.usersFile`                           |
+| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`             | Same as `traefik.frontend.auth.forward.address`                            |
+| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`                | Same as `traefik.frontend.auth.forward.authResponseHeaders`                |
+| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Same as `traefik.frontend.auth.forward.tls.ca`                             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                     | Same as `traefik.frontend.auth.forward.tls.caOptional`                     |
+| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`               | Same as `traefik.frontend.auth.forward.tls.cert`                           |
+| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`             | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`                | Same as `traefik.frontend.auth.forward.tls.key`                            |
+| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`                 | Same as `traefik.frontend.auth.forward.trustForwardHeader`                 |
+| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                      | Same as `traefik.frontend.auth.headerField`                                |
+| `traefik.<segment_name>.frontend.auth.removeHeader=true`                               | Same as `traefik.frontend.auth.removeHeader`                               |
+| `traefik.<segment_name>.frontend.entryPoints=https`                                    | Same as `traefik.frontend.entryPoints`                                     |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                           | Same as `traefik.frontend.errors.<name>.backend`                           |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                             | Same as `traefik.frontend.errors.<name>.query`                             |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                           | Same as `traefik.frontend.errors.<name>.status`                            |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                                  | Same as `traefik.frontend.passHostHeader`                                  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName`       |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.country=true`          | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country`          |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent`  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.locality=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.organization=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.province=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`                | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`                |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`               | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`               |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                    | Same as `traefik.frontend.passTLSClientCert.infos.sans`                    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`      | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`      |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`         | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                           | Same as `traefik.frontend.passTLSClientCert.infos.pem`                     |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                                     | Same as `traefik.frontend.passTLSCert`                                     |
+| `traefik.<segment_name>.frontend.priority=10`                                          | Same as `traefik.frontend.priority`                                        |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                          | Same as `traefik.frontend.rateLimit.extractorFunc`                         |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                    | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`                 |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`                   | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`                |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                     | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`                  |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                            | Same as `traefik.frontend.redirect.entryPoint`                             |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`                | Same as `traefik.frontend.redirect.regex`                                  |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`              | Same as `traefik.frontend.redirect.replacement`                            |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                              | Same as `traefik.frontend.redirect.permanent`                              |
+| `traefik.<segment_name>.frontend.rule=EXP`                                             | Same as `traefik.frontend.rule`                                            |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                          | Same as `traefik.frontend.whiteList.sourceRange`                           |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                      | Same as `traefik.frontend.whiteList.useXForwardedFor`                      |

 #### Custom Headers

--- a/docs/configuration/backends/file.md
+++ b/docs/configuration/backends/file.md
@@ -64,16 +64,21 @@ Traefik can be configured with a file.
      "test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
    ]
    [frontends.frontend1.passTLSClientCert]
-        # Pass the escaped pem in a `X-Forwarded-Ssl-Client-Cert` header
        pem = true
-        # Pass the escaped client cert infos selected below in a `X-Forwarded-Ssl-Client-Cert-Infos` header
-        # The unescaped header is like `Subject="C=%s,ST=%s,L=%s,O=%s,CN=%s",NB=%d,NA=%d,SAN=%s`
-        # It there is more than one certificates, their are separated by a `;`
-        [frontends.frontend-server.passTLSClientCert.infos]
+        [frontends.frontend1.passTLSClientCert.infos]
            notBefore = true
            notAfter = true
-            [frontends.frontend-server.passTLSClientCert.infos.subject]
+            [frontends.frontend1.passTLSClientCert.infos.subject]
                country = true
+                domainComponent = true
+                province = true
+                locality = true
+                organization = true
+                commonName = true
+                serialNumber = true
+            [frontends.frontend1.passTLSClientCert.infos.issuer]
+                country = true
+                domainComponent = true
                province = true
                locality = true
                organization = true
--- a/docs/configuration/backends/kubernetes.md
+++ b/docs/configuration/backends/kubernetes.md
@@ -128,10 +128,11 @@ This will give more flexibility in cloud/dynamic environments.
 Traefik automatically requests endpoint information based on the service provided in the ingress spec.
 Although traefik will connect directly to the endpoints (pods), it still checks the service port to see if TLS communication is required.

-There are 2 ways to configure Traefik to use https to communicate with backend pods:
+There are 3 ways to configure Traefik to use https to communicate with backend pods:

 1. If the service port defined in the ingress spec is 443 (note that you can still use `targetPort` to use a different port on your pod).
 2. If the service port defined in the ingress spec has a name that starts with `https` (such as `https-api`, `https-web` or just `https`).
+3. If the ingress spec includes the annotation `ingress.kubernetes.io/protocol: https`.

 If either of those configuration options exist, then the backend communication protocol is assumed to be TLS, and will connect via TLS automatically.

@@ -166,7 +167,7 @@ The following general annotations are applicable on the Ingress object:
 | `traefik.ingress.kubernetes.io/service-weights: <YML>`                          | Set ingress backend weights specified as percentage or decimal numbers in YAML. (6)                                                                                                        |
 | `traefik.ingress.kubernetes.io/whitelist-source-range: "1.2.3.0/24, fe80::/16"` | A comma-separated list of IP ranges permitted for access (7).                                                                                                                              |
 | `ingress.kubernetes.io/whitelist-x-forwarded-for: "true"`                       | Use `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                     |
-| `ingress.kubernetes.io/protocol: <NAME>`                                        | Set the protocol Traefik will use to communicate with pods.                                                                                                                                |
+| `ingress.kubernetes.io/protocol:<NAME>`                                | Set the protocol Traefik will use to communicate with pods. Acceptable protocols: http,https,h2c                                                                                                                        |

 <1> `traefik.ingress.kubernetes.io/app-root`:
 Non-root paths will not be affected by this annotation and handled normally.
@@ -316,7 +317,7 @@ The following security annotations are applicable on the Ingress object:
 | `ingress.kubernetes.io/custom-browser-xss-value: VALUE`   | Set custom value for X-XSS-Protection header. This overrides the BrowserXssFilter option.                                                                                                           |
 | `ingress.kubernetes.io/custom-frame-options-value: VALUE` | Overrides the `X-Frame-Options` header with the custom value.                                                                                                                                       |
 | `ingress.kubernetes.io/force-hsts: "false"`               | Adds the STS  header to non-SSL requests.                                                                                                                                                           |
-| `ingress.kubernetes.io/frame-deny: "false"`               | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
+| `ingress.kubernetes.io/frame-deny: "true"`                | Adds the `X-Frame-Options` header with the value of `DENY`.                                                                                                                                         |
 | `ingress.kubernetes.io/hsts-max-age: "315360000"`         | Sets the max-age of the HSTS header.                                                                                                                                                                |
 | `ingress.kubernetes.io/hsts-include-subdomains: "true"`   | Adds the IncludeSubdomains section of the STS  header.                                                                                                                                              |
 | `ingress.kubernetes.io/hsts-preload: "true"`              | Adds the preload flag to the HSTS  header.                                                                                                                                                          |
--- a/docs/configuration/backends/marathon.md
+++ b/docs/configuration/backends/marathon.md
@@ -193,79 +193,87 @@ They may be specified on one of two levels: Application or service.

 The following labels can be defined on Marathon applications. They adjust the behavior for the entire application.

-| Label                                                               | Description                                                                                                                                                                                                                   |
-|---------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.domain`                                                    | Sets the default base domain used for the frontend rules.                                                                                                                                                                          |
-| `traefik.enable=false`                                              | Disables this container in Traefik.                                                                                                                                                                                            |
-| `traefik.port=80`                                                   | Registers this port. Useful when the container exposes multiples ports.                                                                                                                                                       |
-| `traefik.portIndex=1`                                               | Registers port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                                 |
-| `traefik.protocol=https`                                            | Overrides the default `http` protocol.                                                                                                                                                                                        |
-| `traefik.weight=10`                                                 | Assigns this weight to the container.                                                                                                                                                                                         |
-| `traefik.backend=foo`                                               | Gives the name `foo` to the generated backend for this container.                                                                                                                                                             |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.retryExpression=EXPR`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.circuitbreaker.expression=EXPR`                    | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                 |
-| `traefik.backend.responseForwarding.flushInterval=10ms`             | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
-| `traefik.backend.healthcheck.path=/health`                          | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
-| `traefik.backend.healthcheck.interval=1s`                           | Defines the health check interval. (Default: 30s)                                                                                                                                                                             |
-| `traefik.backend.healthcheck.port=8080`                             | Sets a different port for the health check.                                                                                                                                                                                   |
-| `traefik.backend.healthcheck.scheme=http`                           | Overrides the server URL scheme.                                                                                                                                                                                              |
-| `traefik.backend.healthcheck.hostname=foobar.com`                   | Defines the health check hostname.                                                                                                                                                                                            |
-| `traefik.backend.healthcheck.headers=EXPR`                          | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
-| `traefik.backend.loadbalancer.method=drr`                           | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
-| `traefik.backend.loadbalancer.stickiness=true`                      | Enables backend sticky sessions                                                                                                                                                                                               |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`           | Sets the cookie name manually for sticky sessions                                                                                                                                                                             |
-| `traefik.backend.loadbalancer.sticky=true`                          | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                  |
-| `traefik.backend.maxconn.amount=10`                                 | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
-| `traefik.backend.maxconn.extractorfunc=client.ip`                   | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
-| `traefik.frontend.auth.basic=EXPR`                                  | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
-| `traefik.frontend.auth.basic.removeHeader=true`                     | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `traefik.frontend.auth.basic.users=EXPR`                            | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
-| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`             | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
-| `traefik.frontend.auth.digest.removeHeader=true`                    | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `traefik.frontend.auth.digest.users=EXPR`                           | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
-| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`            | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
-| `traefik.frontend.auth.forward.address=https://example.com`         | Sets the URL of the authentication server.                                                                                                                                                                                    |
-| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`            | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
-| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
-| `traefik.frontend.auth.forward.tls.caOptional=true`                 | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`           | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`         | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
-| `traefik.frontend.auth.forward.tls.key=/path/server.key`            | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `traefik.frontend.auth.forward.trustForwardHeader=true`             | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
-| `traefik.frontend.auth.headerField=X-WebAuth-User`                  | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
-| `traefik.frontend.auth.removeHeader=true`                           | If set to true, removes the Authorization header.                                                                                                                                                                             |
-| `traefik.frontend.entryPoints=http,https`                           | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
-| `traefik.frontend.errors.<name>.backend=NAME`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.errors.<name>.query=PATH`                         | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.errors.<name>.status=RANGE`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.passHostHeader=true`                              | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
-| `traefik.frontend.passTLSClientCert.infos.notAfter=true`            | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
-| `traefik.frontend.passTLSClientCert.infos.notBefore=true`           | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
-| `traefik.frontend.passTLSClientCert.infos.sans=true`                | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`  | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
-| `traefik.frontend.passTLSClientCert.infos.subject.country=true`     | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`    | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.subject.province=true`    | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `traefik.frontend.passTLSClientCert.pem=true`                       | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
-| `traefik.frontend.passTLSCert=true`                                 | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
-| `traefik.frontend.priority=10`                                      | Overrides default frontend priority                                                                                                                                                                                           |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`                      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`               | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                 | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.redirect.entryPoint=https`                        | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                          |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`            | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1`          | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
-| `traefik.frontend.redirect.permanent=true`                          | Returns 301 instead of 302.                                                                                                                                                                                                   |
-| `traefik.frontend.rule=EXPR`                                        | Overrides the default frontend rule. Default: `Host:{sub_domain}.{domain}`.                                                                                                                                                   |
-| `traefik.frontend.whiteList.sourceRange=RANGE`                      | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`                  | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |
+| Label                                                                   | Description                                                                                                                                                                                                                   |
+|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                                        | Sets the default base domain used for the frontend rules.                                                                                                                                                                     |
+| `traefik.enable=false`                                                  | Disables this container in Traefik.                                                                                                                                                                                           |
+| `traefik.port=80`                                                       | Registers this port. Useful when the container exposes multiples ports.                                                                                                                                                       |
+| `traefik.portIndex=1`                                                   | Registers port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                                 |
+| `traefik.protocol=https`                                                | Overrides the default `http` protocol.                                                                                                                                                                                        |
+| `traefik.weight=10`                                                     | Assigns this weight to the container.                                                                                                                                                                                         |
+| `traefik.backend=foo`                                                   | Overrides the application name by `foo` in the generated name of the backend.                                                                                                                                                 |
+| `traefik.backend.buffering.maxRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.maxResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.retryExpression=EXPR`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.circuitbreaker.expression=EXPR`                        | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                 |
+| `traefik.backend.responseForwarding.flushInterval=10ms`                 | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
+| `traefik.backend.healthcheck.path=/health`                              | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
+| `traefik.backend.healthcheck.interval=1s`                               | Defines the health check interval. (Default: 30s)                                                                                                                                                                             |
+| `traefik.backend.healthcheck.port=8080`                                 | Sets a different port for the health check.                                                                                                                                                                                   |
+| `traefik.backend.healthcheck.scheme=http`                               | Overrides the server URL scheme.                                                                                                                                                                                              |
+| `traefik.backend.healthcheck.hostname=foobar.com`                       | Defines the health check hostname.                                                                                                                                                                                            |
+| `traefik.backend.healthcheck.headers=EXPR`                              | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
+| `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
+| `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                               |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions                                                                                                                                                                             |
+| `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                  |
+| `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
+| `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
+| `traefik.frontend.auth.basic=EXPR`                                      | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
+| `traefik.frontend.auth.basic.removeHeader=true`                         | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `traefik.frontend.auth.basic.users=EXPR`                                | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
+| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
+| `traefik.frontend.auth.digest.removeHeader=true`                        | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `traefik.frontend.auth.digest.users=EXPR`                               | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
+| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`                | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
+| `traefik.frontend.auth.forward.address=https://example.com`             | Sets the URL of the authentication server.                                                                                                                                                                                    |
+| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`                | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
+| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
+| `traefik.frontend.auth.forward.tls.caOptional=true`                     | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`               | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`             | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
+| `traefik.frontend.auth.forward.tls.key=/path/server.key`                | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `traefik.frontend.auth.forward.trustForwardHeader=true`                 | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
+| `traefik.frontend.auth.headerField=X-WebAuth-User`                      | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
+| `traefik.frontend.auth.removeHeader=true`                               | If set to true, removes the Authorization header.                                                                                                                                                                             |
+| `traefik.frontend.entryPoints=http,https`                               | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
+| `traefik.frontend.errors.<name>.backend=NAME`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.errors.<name>.query=PATH`                             | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.errors.<name>.status=RANGE`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.passHostHeader=true`                                  | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
+| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.issuer.country=true`          | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                     |
+| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                             |
+| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true`         | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true`     | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.issuer.province=true`         | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.notAfter=true`                | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
+| `traefik.frontend.passTLSClientCert.infos.notBefore=true`               | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
+| `traefik.frontend.passTLSClientCert.infos.sans=true`                    | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`      | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
+| `traefik.frontend.passTLSClientCert.infos.subject.country=true`         | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                            |
+| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`        | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`    | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.province=true`        | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.pem=true`                           | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
+| `traefik.frontend.passTLSCert=true`                                     | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
+| `traefik.frontend.priority=10`                                          | Overrides default frontend priority                                                                                                                                                                                           |
+| `traefik.frontend.rateLimit.extractorFunc=EXP`                          | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                    | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.average=6`                   | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                     | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.redirect.entryPoint=https`                            | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                          |
+| `traefik.frontend.redirect.regex=^http://localhost/(.*)`                | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
+| `traefik.frontend.redirect.replacement=http://mydomain/$1`              | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
+| `traefik.frontend.redirect.permanent=true`                              | Returns 301 instead of 302.                                                                                                                                                                                                   |
+| `traefik.frontend.rule=EXPR`                                            | Overrides the default frontend rule. Default: `Host:{sub_domain}.{domain}`.                                                                                                                                                   |
+| `traefik.frontend.whiteList.sourceRange=RANGE`                          | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.frontend.whiteList.useXForwardedFor=true`                      | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |

 #### Custom Headers

@@ -308,59 +316,67 @@ You can define as many segments as ports exposed in an application.

 Segment labels override the default behavior.

-| Label                                                                              | Description                                                            |
-|------------------------------------------------------------------------------------|------------------------------------------------------------------------|
-| `traefik.<segment_name>.backend=BACKEND`                                           | Same as `traefik.backend`                                              |
-| `traefik.<segment_name>.domain=DOMAIN`                                             | Same as `traefik.domain`                                               |
-| `traefik.<segment_name>.portIndex=1`                                               | Same as `traefik.portIndex`                                            |
-| `traefik.<segment_name>.port=PORT`                                                 | Same as `traefik.port`                                                 |
-| `traefik.<segment_name>.protocol=http`                                             | Same as `traefik.protocol`                                             |
-| `traefik.<segment_name>.weight=10`                                                 | Same as `traefik.weight`                                               |
-| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                  | Same as `traefik.frontend.auth.basic`                                  |
-| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                     | Same as `traefik.frontend.auth.basic.removeHeader`                     |
-| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                            | Same as `traefik.frontend.auth.basic.users`                            |
-| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`             | Same as `traefik.frontend.auth.basic.usersFile`                        |
-| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                    | Same as `traefik.frontend.auth.digest.removeHeader`                    |
-| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                           | Same as `traefik.frontend.auth.digest.users`                           |
-| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`            | Same as `traefik.frontend.auth.digest.usersFile`                       |
-| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`         | Same as `traefik.frontend.auth.forward.address`                        |
-| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`            | Same as `traefik.frontend.auth.forward.authResponseHeaders`            |
-| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Same as `traefik.frontend.auth.forward.tls.ca`                         |
-| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                 | Same as `traefik.frontend.auth.forward.tls.caOptional`                 |
-| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`           | Same as `traefik.frontend.auth.forward.tls.cert`                       |
-| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`         | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`         |
-| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`            | Same as `traefik.frontend.auth.forward.tls.key`                        |
-| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`             | Same as `traefik.frontend.auth.forward.trustForwardHeader`             |
-| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                  | Same as `traefik.frontend.auth.headerField`                            |
-| `traefik.<segment_name>.frontend.auth.removeHeader=true`                           | Same as `traefik.frontend.auth.removeHeader`                           |
-| `traefik.<segment_name>.frontend.entryPoints=https`                                | Same as `traefik.frontend.entryPoints`                                 |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                       | Same as `traefik.frontend.errors.<name>.backend`                       |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                         | Same as `traefik.frontend.errors.<name>.query`                         |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                       | Same as `traefik.frontend.errors.<name>.status`                        |
-| `traefik.<segment_name>.frontend.passHostHeader=true`                              | Same as `traefik.frontend.passHostHeader`                              |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`            | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`            |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`           | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`           |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                | Same as `traefik.frontend.passTLSClientCert.infos.sans`                |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`  | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`  |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`     | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`     |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`    |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`|
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`    |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`|
-| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                       | Same as `traefik.frontend.passTLSClientCert.infos.pem`                 |
-| `traefik.<segment_name>.frontend.passTLSCert=true`                                 | Same as `traefik.frontend.passTLSCert`                                 |
-| `traefik.<segment_name>.frontend.priority=10`                                      | Same as `traefik.frontend.priority`                                    |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                      | Same as `traefik.frontend.rateLimit.extractorFunc`                     |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`             |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`               | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`            |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                 | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                        | Same as `traefik.frontend.redirect.entryPoint`                         |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`            | Same as `traefik.frontend.redirect.regex`                              |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`          | Same as `traefik.frontend.redirect.replacement`                        |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                          | Same as `traefik.frontend.redirect.permanent`                          |
-| `traefik.<segment_name>.frontend.rule=EXP`                                         | Same as `traefik.frontend.rule`                                        |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                      | Same as `traefik.frontend.whiteList.sourceRange`                       |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                  | Same as `traefik.frontend.whiteList.useXForwardedFor`                  |
+| Label                                                                                  | Description                                                                |
+|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------|
+| `traefik.<segment_name>.backend=BACKEND`                                               | Same as `traefik.backend`                                                  |
+| `traefik.<segment_name>.domain=DOMAIN`                                                 | Same as `traefik.domain`                                                   |
+| `traefik.<segment_name>.portIndex=1`                                                   | Same as `traefik.portIndex`                                                |
+| `traefik.<segment_name>.port=PORT`                                                     | Same as `traefik.port`                                                     |
+| `traefik.<segment_name>.protocol=http`                                                 | Same as `traefik.protocol`                                                 |
+| `traefik.<segment_name>.weight=10`                                                     | Same as `traefik.weight`                                                   |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                      | Same as `traefik.frontend.auth.basic`                                      |
+| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                         | Same as `traefik.frontend.auth.basic.removeHeader`                         |
+| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                                | Same as `traefik.frontend.auth.basic.users`                                |
+| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Same as `traefik.frontend.auth.basic.usersFile`                            |
+| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                        | Same as `traefik.frontend.auth.digest.removeHeader`                        |
+| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                               | Same as `traefik.frontend.auth.digest.users`                               |
+| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`                | Same as `traefik.frontend.auth.digest.usersFile`                           |
+| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`             | Same as `traefik.frontend.auth.forward.address`                            |
+| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`                | Same as `traefik.frontend.auth.forward.authResponseHeaders`                |
+| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Same as `traefik.frontend.auth.forward.tls.ca`                             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                     | Same as `traefik.frontend.auth.forward.tls.caOptional`                     |
+| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`               | Same as `traefik.frontend.auth.forward.tls.cert`                           |
+| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`             | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`                | Same as `traefik.frontend.auth.forward.tls.key`                            |
+| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`                 | Same as `traefik.frontend.auth.forward.trustForwardHeader`                 |
+| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                      | Same as `traefik.frontend.auth.headerField`                                |
+| `traefik.<segment_name>.frontend.auth.removeHeader=true`                               | Same as `traefik.frontend.auth.removeHeader`                               |
+| `traefik.<segment_name>.frontend.entryPoints=https`                                    | Same as `traefik.frontend.entryPoints`                                     |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                           | Same as `traefik.frontend.errors.<name>.backend`                           |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                             | Same as `traefik.frontend.errors.<name>.query`                             |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                           | Same as `traefik.frontend.errors.<name>.status`                            |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                                  | Same as `traefik.frontend.passHostHeader`                                  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName`       |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent`  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.country=true`          | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country`          |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.locality=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.organization=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.province=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`                | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`                |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`               | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`               |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                    | Same as `traefik.frontend.passTLSClientCert.infos.sans`                    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`      | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`      |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`         | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                           | Same as `traefik.frontend.passTLSClientCert.infos.pem`                     |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                                     | Same as `traefik.frontend.passTLSCert`                                     |
+| `traefik.<segment_name>.frontend.priority=10`                                          | Same as `traefik.frontend.priority`                                        |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                          | Same as `traefik.frontend.rateLimit.extractorFunc`                         |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                    | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`                 |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`                   | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`                |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                     | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`                  |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                            | Same as `traefik.frontend.redirect.entryPoint`                             |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`                | Same as `traefik.frontend.redirect.regex`                                  |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`              | Same as `traefik.frontend.redirect.replacement`                            |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                              | Same as `traefik.frontend.redirect.permanent`                              |
+| `traefik.<segment_name>.frontend.rule=EXP`                                             | Same as `traefik.frontend.rule`                                            |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                          | Same as `traefik.frontend.whiteList.sourceRange`                           |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                      | Same as `traefik.frontend.whiteList.useXForwardedFor`                      |

 #### Custom Headers

--- a/docs/configuration/backends/mesos.md
+++ b/docs/configuration/backends/mesos.md
@@ -106,79 +106,87 @@ domain = "mesos.localhost"

 The following labels can be defined on Mesos tasks. They adjust the behavior for the entire application.

-| Label                                                               | Description                                                                                                                                                                                                                   |
-|---------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.domain`                                                    | Sets the default base domain for the frontend rules.                                                                                                                                                                               |
-| `traefik.enable=false`                                              | Disables this container in Traefik.                                                                                                                                                                                            |
-| `traefik.port=80`                                                   | Registers this port. Useful when the application exposes multiple ports.                                                                                                                                                      |
-| `traefik.portName=web`                                              | Registers port by name in the application's ports array. Useful when the application exposes multiple ports.                                                                                                                  |
-| `traefik.portIndex=1`                                               | Registers port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                                 |
-| `traefik.protocol=https`                                            | Overrides the default `http` protocol                                                                                                                                                                                         |
-| `traefik.weight=10`                                                 | Assigns this weight to the container                                                                                                                                                                                          |
-| `traefik.backend=foo`                                               | Gives the name `foo` to the generated backend for this container.                                                                                                                                                             |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.memResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.buffering.retryExpression=EXPR`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
-| `traefik.backend.circuitbreaker.expression=EXPR`                    | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                 |
-| `traefik.backend.responseForwarding.flushInterval=10ms`             | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
-| `traefik.backend.healthcheck.path=/health`                          | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
-| `traefik.backend.healthcheck.interval=1s`                           | Defines the health check interval. (Default: 30s)                                                                                                                                                                             |
-| `traefik.backend.healthcheck.scheme=http`                           | Overrides the server URL scheme.                                                                                                                                                                                              |
-| `traefik.backend.healthcheck.port=8080`                             | Sets a different port for the health check.                                                                                                                                                                                   |
-| `traefik.backend.healthcheck.hostname=foobar.com`                   | Defines the health check hostname.                                                                                                                                                                                            |
-| `traefik.backend.healthcheck.headers=EXPR`                          | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
-| `traefik.backend.loadbalancer.method=drr`                           | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
-| `traefik.backend.loadbalancer.stickiness=true`                      | Enables backend sticky sessions                                                                                                                                                                                               |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`           | Sets the cookie manually name for sticky sessions                                                                                                                                                                             |
-| `traefik.backend.maxconn.amount=10`                                 | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
-| `traefik.backend.maxconn.extractorfunc=client.ip`                   | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
-| `traefik.frontend.auth.basic=EXPR`                                  | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
-| `traefik.frontend.auth.basic.users=EXPR`                            | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
-| `traefik.frontend.auth.basic.removeHeader=true`                     | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`             | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
-| `traefik.frontend.auth.digest.removeHeader=true`                    | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
-| `traefik.frontend.auth.digest.users=EXPR`                           | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
-| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`            | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
-| `traefik.frontend.auth.forward.address=https://example.com`         | Sets the URL of the authentication server.                                                                                                                                                                                    |
-| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`            | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
-| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
-| `traefik.frontend.auth.forward.tls.caOptional=true`                 | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`           | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`         | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
-| `traefik.frontend.auth.forward.tls.key=/path/server.key`            | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
-| `traefik.frontend.auth.forward.trustForwardHeader=true`             | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
-| `traefik.frontend.auth.headerField=X-WebAuth-User`                  | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
-| `traefik.frontend.auth.removeHeader=true`                           | If set to true, removes the Authorization header.                                                                                                                                                                             |
-| `traefik.frontend.entryPoints=http,https`                           | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
-| `traefik.frontend.errors.<name>.backend=NAME`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.errors.<name>.query=PATH`                         | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.errors.<name>.status=RANGE`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
-| `traefik.frontend.passHostHeader=true`                              | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
-| `traefik.frontend.passTLSClientCert.infos.notAfter=true`            | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
-| `traefik.frontend.passTLSClientCert.infos.notBefore=true`           | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
-| `traefik.frontend.passTLSClientCert.infos.sans=true`                | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`  | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
-| `traefik.frontend.passTLSClientCert.infos.subject.country=true`     | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`    | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.subject.province=true`    | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
-| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
-| `traefik.frontend.passTLSClientCert.pem=true`                       | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
-| `traefik.frontend.passTLSCert=true`                                 | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
-| `traefik.frontend.priority=10`                                      | Overrides default frontend priority                                                                                                                                                                                           |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`                      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`               | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                 | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
-| `traefik.frontend.redirect.entryPoint=https`                        | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                          |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`            | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1`          | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
-| `traefik.frontend.redirect.permanent=true`                          | Returns 301 instead of 302.                                                                                                                                                                                                   |
-| `traefik.frontend.rule=EXPR`                                        | Overrides the default frontend rule. Default: `Host:{discovery_name}.{domain}`.                                                                                                                                               |
-| `traefik.frontend.whiteList.sourceRange=RANGE`                      | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`                  | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |
+| Label                                                                   | Description                                                                                                                                                                                                                   |
+|-------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                                        | Sets the default base domain for the frontend rules.                                                                                                                                                                          |
+| `traefik.enable=false`                                                  | Disables this container in Traefik.                                                                                                                                                                                           |
+| `traefik.port=80`                                                       | Registers this port. Useful when the application exposes multiple ports.                                                                                                                                                      |
+| `traefik.portName=web`                                                  | Registers port by name in the application's ports array. Useful when the application exposes multiple ports.                                                                                                                  |
+| `traefik.portIndex=1`                                                   | Registers port by index in the application's ports array. Useful when the application exposes multiple ports.                                                                                                                 |
+| `traefik.protocol=https`                                                | Overrides the default `http` protocol                                                                                                                                                                                         |
+| `traefik.weight=10`                                                     | Assigns this weight to the container                                                                                                                                                                                          |
+| `traefik.backend=foo`                                                   | Overrides the task name by `foo` in the generated name of the backend.                                                                                                                                                        |
+| `traefik.backend.buffering.maxRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.maxResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.memResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.buffering.retryExpression=EXPR`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                   |
+| `traefik.backend.circuitbreaker.expression=EXPR`                        | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                 |
+| `traefik.backend.responseForwarding.flushInterval=10ms`                 | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                     |
+| `traefik.backend.healthcheck.path=/health`                              | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                        |
+| `traefik.backend.healthcheck.interval=1s`                               | Defines the health check interval. (Default: 30s)                                                                                                                                                                             |
+| `traefik.backend.healthcheck.scheme=http`                               | Overrides the server URL scheme.                                                                                                                                                                                              |
+| `traefik.backend.healthcheck.port=8080`                                 | Sets a different port for the health check.                                                                                                                                                                                   |
+| `traefik.backend.healthcheck.hostname=foobar.com`                       | Defines the health check hostname.                                                                                                                                                                                            |
+| `traefik.backend.healthcheck.headers=EXPR`                              | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                     |
+| `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                           |
+| `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                               |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie manually name for sticky sessions                                                                                                                                                                             |
+| `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                      |
+| `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                        |
+| `traefik.frontend.auth.basic=EXPR`                                      | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                 |
+| `traefik.frontend.auth.basic.users=EXPR`                                | Sets basic authentication to this frontend in CSV format: `User:Hash,User:Hash`.                                                                                                                                              |
+| `traefik.frontend.auth.basic.removeHeader=true`                         | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Sets basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                         |
+| `traefik.frontend.auth.digest.removeHeader=true`                        | If set to `true`, removes the `Authorization` header.                                                                                                                                                                         |
+| `traefik.frontend.auth.digest.users=EXPR`                               | Sets digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                 |
+| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`                | Sets digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
+| `traefik.frontend.auth.forward.address=https://example.com`             | Sets the URL of the authentication server.                                                                                                                                                                                    |
+| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`                | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                |
+| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                    |
+| `traefik.frontend.auth.forward.tls.caOptional=true`                     | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`               | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`             | If set to true invalid SSL certificates are accepted.                                                                                                                                                                         |
+| `traefik.frontend.auth.forward.tls.key=/path/server.key`                | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                   |
+| `traefik.frontend.auth.forward.trustForwardHeader=true`                 | Trusts X-Forwarded-* headers.                                                                                                                                                                                                 |
+| `traefik.frontend.auth.headerField=X-WebAuth-User`                      | Sets the header used to pass the authenticated user to the application.                                                                                                                                                       |
+| `traefik.frontend.auth.removeHeader=true`                               | If set to true, removes the Authorization header.                                                                                                                                                                             |
+| `traefik.frontend.entryPoints=http,https`                               | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                   |
+| `traefik.frontend.errors.<name>.backend=NAME`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.errors.<name>.query=PATH`                             | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.errors.<name>.status=RANGE`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                 |
+| `traefik.frontend.passHostHeader=true`                                  | Forwards client `Host` header to the backend.                                                                                                                                                                                 |
+| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.issuer.country=true`          | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                     |
+| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                             |
+| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true`         | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true`     | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.issuer.province=true`         | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.notAfter=true`                | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                            |
+| `traefik.frontend.passTLSClientCert.infos.notBefore=true`               | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                           |
+| `traefik.frontend.passTLSClientCert.infos.sans=true`                    | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`      | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                 |
+| `traefik.frontend.passTLSClientCert.infos.subject.country=true`         | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                            |
+| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`        | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`    | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.province=true`        | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.pem=true`                           | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                             |
+| `traefik.frontend.passTLSCert=true`                                     | Forwards TLS Client certificates to the backend.                                                                                                                                                                              |
+| `traefik.frontend.priority=10`                                          | Overrides default frontend priority                                                                                                                                                                                           |
+| `traefik.frontend.rateLimit.extractorFunc=EXP`                          | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                    | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.average=6`                   | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                     | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                           |
+| `traefik.frontend.redirect.entryPoint=https`                            | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                          |
+| `traefik.frontend.redirect.regex=^http://localhost/(.*)`                | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                       |
+| `traefik.frontend.redirect.replacement=http://mydomain/$1`              | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                             |
+| `traefik.frontend.redirect.permanent=true`                              | Returns 301 instead of 302.                                                                                                                                                                                                   |
+| `traefik.frontend.rule=EXPR`                                            | Overrides the default frontend rule. Default: `Host:{discovery_name}.{domain}`.                                                                                                                                               |
+| `traefik.frontend.whiteList.sourceRange=RANGE`                          | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access. If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.frontend.whiteList.useXForwardedFor=true`                      | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                       |

 ### Custom Headers

--- a/docs/configuration/backends/rancher.md
+++ b/docs/configuration/backends/rancher.md
@@ -138,77 +138,85 @@ secretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

 Labels can be used on task containers to override default behavior:

-| Label                                                               | Description                                                                                                                                                                                                                      |
-|---------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `traefik.domain`                                                    | Sets the default base domain for the frontend rules.                                                                                                                                                                             |
-| `traefik.enable=false`                                              | Disables this container in Traefik.                                                                                                                                                                                              |
-| `traefik.port=80`                                                   | Registers this port. Useful when the container exposes multiple ports.                                                                                                                                                           |
-| `traefik.protocol=https`                                            | Overrides the default `http` protocol.                                                                                                                                                                                           |
-| `traefik.weight=10`                                                 | Assigns this weight to the container.                                                                                                                                                                                            |
-| `traefik.backend=foo`                                               | Gives the name `foo` to the generated backend for this container.                                                                                                                                                                |
-| `traefik.backend.buffering.maxRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.maxResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.memRequestBodyBytes=0`                   | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.memResponseBodyBytes=0`                  | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.buffering.retryExpression=EXPR`                    | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
-| `traefik.backend.circuitbreaker.expression=EXPR`                    | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                    |
-| `traefik.backend.responseForwarding.flushInterval=10ms`             | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                        |
-| `traefik.backend.healthcheck.path=/health`                          | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                           |
-| `traefik.backend.healthcheck.interval=1s`                           | Defines the health check interval.                                                                                                                                                                                               |
-| `traefik.backend.healthcheck.port=8080`                             | Sets a different port for the health check.                                                                                                                                                                                      |
-| `traefik.backend.healthcheck.scheme=http`                           | Overrides the server URL scheme.                                                                                                                                                                                                 |
-| `traefik.backend.healthcheck.hostname=foobar.com`                   | Defines the health check hostname.                                                                                                                                                                                               |
-| `traefik.backend.healthcheck.headers=EXPR`                          | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                        |
-| `traefik.backend.loadbalancer.method=drr`                           | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                              |
-| `traefik.backend.loadbalancer.stickiness=true`                      | Enables backend sticky sessions                                                                                                                                                                                                  |
-| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`           | Sets the cookie name manually for sticky sessions                                                                                                                                                                                |
-| `traefik.backend.loadbalancer.sticky=true`                          | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                     |
-| `traefik.backend.maxconn.amount=10`                                 | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                         |
-| `traefik.backend.maxconn.extractorfunc=client.ip`                   | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                           |
-| `traefik.frontend.auth.basic=EXPR`                                  | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                |
-| `traefik.frontend.auth.basic.removeHeader=true`                     | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
-| `traefik.frontend.auth.basic.users=EXPR`                            | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` .                                                                                                                                            |
-| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`             | Sets the basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
-| `traefik.frontend.auth.digest.removeHeader=true`                    | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
-| `traefik.frontend.auth.digest.users=EXPR`                           | Sets the digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                |
-| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`            | Sets the digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                       |
-| `traefik.frontend.auth.forward.address=https://example.com`         | Sets the URL of the authentication server.                                                                                                                                                                                       |
-| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`            | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                   |
-| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                       |
-| `traefik.frontend.auth.forward.tls.caOptional=true`                 | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                      |
-| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`           | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
-| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`         | If set to true invalid SSL certificates are accepted.                                                                                                                                                                            |
-| `traefik.frontend.auth.forward.tls.key=/path/server.key`            | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
-| `traefik.frontend.auth.forward.trustForwardHeader=true`             | Trusts X-Forwarded-* headers.                                                                                                                                                                                                    |
-| `traefik.frontend.auth.headerField=X-WebAuth-User`                  | Sets the header used to pass the authenticated user to the application.                                                                                                                                                          |
-| `traefik.frontend.entryPoints=http,https`                           | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                      |
-| `traefik.frontend.errors.<name>.backend=NAME`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
-| `traefik.frontend.errors.<name>.query=PATH`                         | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
-| `traefik.frontend.errors.<name>.status=RANGE`                       | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
-| `traefik.frontend.passHostHeader=true`                              | Forwards client `Host` header to the backend.                                                                                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.notAfter=true`            | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
-| `traefik.frontend.passTLSClientCert.infos.notBefore=true`           | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                              |
-| `traefik.frontend.passTLSClientCert.infos.sans=true`                | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                                  |
-| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`  | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
-| `traefik.frontend.passTLSClientCert.infos.subject.country=true`     | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
-| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`    | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
-| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`| Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
-| `traefik.frontend.passTLSClientCert.infos.subject.province=true`    | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
-| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
-| `traefik.frontend.passTLSClientCert.pem=true`                       | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                                |
-| `traefik.frontend.passTLSCert=true`                                 | Forwards TLS Client certificates to the backend.                                                                                                                                                                                 |
-| `traefik.frontend.priority=10`                                      | Overrides default frontend priority                                                                                                                                                                                              |
-| `traefik.frontend.rateLimit.extractorFunc=EXP`                      | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.rateLimit.rateSet.<name>.average=6`               | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                 | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
-| `traefik.frontend.redirect.entryPoint=https`                        | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                             |
-| `traefik.frontend.redirect.regex=^http://localhost/(.*)`            | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                          |
-| `traefik.frontend.redirect.replacement=http://mydomain/$1`          | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                                |
-| `traefik.frontend.redirect.permanent=true`                          | Returns 301 instead of 302.                                                                                                                                                                                                      |
-| `traefik.frontend.rule=EXPR`                                        | Overrides the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                                     |
-| `traefik.frontend.whiteList.sourceRange=RANGE`                      | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
-| `traefik.frontend.whiteList.useXForwardedFor=true`                  | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                          |
+| Label                                                                   | Description                                                                                                                                                                                                                      |
+|-------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `traefik.domain`                                                        | Sets the default base domain for the frontend rules.                                                                                                                                                                             |
+| `traefik.enable=false`                                                  | Disables this container in Traefik.                                                                                                                                                                                              |
+| `traefik.port=80`                                                       | Registers this port. Useful when the container exposes multiple ports.                                                                                                                                                           |
+| `traefik.protocol=https`                                                | Overrides the default `http` protocol.                                                                                                                                                                                           |
+| `traefik.weight=10`                                                     | Assigns this weight to the container.                                                                                                                                                                                            |
+| `traefik.backend=foo`                                                   | Overrides the service name by `foo` in the generated name of the backend.                                                                                                                                                        |
+| `traefik.backend.buffering.maxRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.maxResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.memRequestBodyBytes=0`                       | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.memResponseBodyBytes=0`                      | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.buffering.retryExpression=EXPR`                        | See [buffering](/configuration/commons/#buffering) section.                                                                                                                                                                      |
+| `traefik.backend.circuitbreaker.expression=EXPR`                        | Creates a [circuit breaker](/basics/#backends) to be used against the backend                                                                                                                                                    |
+| `traefik.backend.responseForwarding.flushInterval=10ms`                 | Defines the interval between two flushes when forwarding response from backend to client.                                                                                                                                        |
+| `traefik.backend.healthcheck.path=/health`                              | Enables health check for the backend, hitting the container at `path`.                                                                                                                                                           |
+| `traefik.backend.healthcheck.interval=1s`                               | Defines the health check interval.                                                                                                                                                                                               |
+| `traefik.backend.healthcheck.port=8080`                                 | Sets a different port for the health check.                                                                                                                                                                                      |
+| `traefik.backend.healthcheck.scheme=http`                               | Overrides the server URL scheme.                                                                                                                                                                                                 |
+| `traefik.backend.healthcheck.hostname=foobar.com`                       | Defines the health check hostname.                                                                                                                                                                                               |
+| `traefik.backend.healthcheck.headers=EXPR`                              | Defines the health check request headers <br>Format:  <code>HEADER:value&vert;&vert;HEADER2:value2</code>                                                                                                                        |
+| `traefik.backend.loadbalancer.method=drr`                               | Overrides the default `wrr` load balancer algorithm                                                                                                                                                                              |
+| `traefik.backend.loadbalancer.stickiness=true`                          | Enables backend sticky sessions                                                                                                                                                                                                  |
+| `traefik.backend.loadbalancer.stickiness.cookieName=NAME`               | Sets the cookie name manually for sticky sessions                                                                                                                                                                                |
+| `traefik.backend.loadbalancer.sticky=true`                              | Enables backend sticky sessions (DEPRECATED)                                                                                                                                                                                     |
+| `traefik.backend.maxconn.amount=10`                                     | Sets a maximum number of connections to the backend.<br>Must be used in conjunction with the below label to take effect.                                                                                                         |
+| `traefik.backend.maxconn.extractorfunc=client.ip`                       | Sets the function to be used against the request to determine what to limit maximum connections to the backend by.<br>Must be used in conjunction with the above label to take effect.                                           |
+| `traefik.frontend.auth.basic=EXPR`                                      | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` (DEPRECATED).                                                                                                                                |
+| `traefik.frontend.auth.basic.removeHeader=true`                         | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
+| `traefik.frontend.auth.basic.users=EXPR`                                | Sets the basic authentication to this frontend in CSV format: `User:Hash,User:Hash` .                                                                                                                                            |
+| `traefik.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Sets the basic authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                        |
+| `traefik.frontend.auth.digest.removeHeader=true`                        | If set to `true`, removes the `Authorization` header.                                                                                                                                                                            |
+| `traefik.frontend.auth.digest.users=EXPR`                               | Sets the digest authentication to this frontend in CSV format: `User:Realm:Hash,User:Realm:Hash`.                                                                                                                                |
+| `traefik.frontend.auth.digest.usersFile=/path/.htdigest`                | Sets the digest authentication with an external file; if users and usersFile are provided, both are merged, with external file contents having precedence.                                                                       |
+| `traefik.frontend.auth.forward.address=https://example.com`             | Sets the URL of the authentication server.                                                                                                                                                                                       |
+| `traefik.frontend.auth.forward.authResponseHeaders=EXPR`                | Sets the forward authentication authResponseHeaders in CSV format: `X-Auth-User,X-Auth-Header`                                                                                                                                   |
+| `traefik.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Sets the Certificate Authority (CA) for the TLS connection with the authentication server.                                                                                                                                       |
+| `traefik.frontend.auth.forward.tls.caOptional=true`                     | Checks the certificates if present but do not force to be signed by a specified Certificate Authority (CA).                                                                                                                      |
+| `traefik.frontend.auth.forward.tls.cert=/path/server.pem`               | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
+| `traefik.frontend.auth.forward.tls.insecureSkipVerify=true`             | If set to true invalid SSL certificates are accepted.                                                                                                                                                                            |
+| `traefik.frontend.auth.forward.tls.key=/path/server.key`                | Sets the Certificate for the TLS connection with the authentication server.                                                                                                                                                      |
+| `traefik.frontend.auth.forward.trustForwardHeader=true`                 | Trusts X-Forwarded-* headers.                                                                                                                                                                                                    |
+| `traefik.frontend.auth.headerField=X-WebAuth-User`                      | Sets the header used to pass the authenticated user to the application.                                                                                                                                                          |
+| `traefik.frontend.entryPoints=http,https`                               | Assigns this frontend to entry points `http` and `https`.<br>Overrides `defaultEntryPoints`                                                                                                                                      |
+| `traefik.frontend.errors.<name>.backend=NAME`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
+| `traefik.frontend.errors.<name>.query=PATH`                             | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
+| `traefik.frontend.errors.<name>.status=RANGE`                           | See [custom error pages](/configuration/commons/#custom-error-pages) section.                                                                                                                                                    |
+| `traefik.frontend.passHostHeader=true`                                  | Forwards client `Host` header to the backend.                                                                                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Add the issuer.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                     |
+| `traefik.frontend.passTLSClientCert.infos.issuer.country=true`          | Add the issuer.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                        |
+| `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Add the issuer.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                |
+| `traefik.frontend.passTLSClientCert.infos.issuer.locality=true`         | Add the issuer.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
+| `traefik.frontend.passTLSClientCert.infos.issuer.organization=true`     | Add the issuer.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.issuer.province=true`         | Add the issuer.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
+| `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Add the issuer.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                   |
+| `traefik.frontend.passTLSClientCert.infos.notAfter=true`                | Add the noAfter field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.notBefore=true`               | Add the noBefore field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                              |
+| `traefik.frontend.passTLSClientCert.infos.sans=true`                    | Add the sans field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.subject.commonName=true`      | Add the subject.commonName field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                    |
+| `traefik.frontend.passTLSClientCert.infos.subject.country=true`         | Add the subject.country field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                       |
+| `traefik.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Add the subject.domainComponent field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                               |
+| `traefik.frontend.passTLSClientCert.infos.subject.locality=true`        | Add the subject.locality field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
+| `traefik.frontend.passTLSClientCert.infos.subject.organization=true`    | Add the subject.organization field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.infos.subject.province=true`        | Add the subject.province field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                      |
+| `traefik.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Add the subject.serialNumber field in a escaped client infos in the `X-Forwarded-Ssl-Client-Cert-Infos` header.                                                                                                                  |
+| `traefik.frontend.passTLSClientCert.pem=true`                           | Pass the escaped pem in the `X-Forwarded-Ssl-Client-Cert` header.                                                                                                                                                                |
+| `traefik.frontend.passTLSCert=true`                                     | Forwards TLS Client certificates to the backend.                                                                                                                                                                                 |
+| `traefik.frontend.priority=10`                                          | Overrides default frontend priority                                                                                                                                                                                              |
+| `traefik.frontend.rateLimit.extractorFunc=EXP`                          | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.rateLimit.rateSet.<name>.period=6`                    | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.rateLimit.rateSet.<name>.average=6`                   | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.rateLimit.rateSet.<name>.burst=6`                     | See [rate limiting](/configuration/commons/#rate-limiting) section.                                                                                                                                                              |
+| `traefik.frontend.redirect.entryPoint=https`                            | Enables Redirect to another entryPoint to this frontend (e.g. HTTPS)                                                                                                                                                             |
+| `traefik.frontend.redirect.regex=^http://localhost/(.*)`                | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.replacement`.                                                                                                                          |
+| `traefik.frontend.redirect.replacement=http://mydomain/$1`              | Redirects to another URL to this frontend.<br>Must be set with `traefik.frontend.redirect.regex`.                                                                                                                                |
+| `traefik.frontend.redirect.permanent=true`                              | Returns 301 instead of 302.                                                                                                                                                                                                      |
+| `traefik.frontend.rule=EXPR`                                            | Overrides the default frontend rule. Default: `Host:{containerName}.{domain}` or `Host:{service}.{project_name}.{domain}` if you are using `docker-compose`.                                                                     |
+| `traefik.frontend.whiteList.sourceRange=RANGE`                          | Sets a list of IP-Ranges which are allowed to access.<br>An unset or empty list allows all Source-IPs to access.<br>If one of the Net-Specifications are invalid, the whole list is invalid and allows all Source-IPs to access. |
+| `traefik.frontend.whiteList.useXForwardedFor=true`                      | Uses `X-Forwarded-For` header as valid source of IP for the white list.                                                                                                                                                          |

 #### Custom Headers

@@ -250,57 +258,65 @@ You can define as many segments as ports exposed in a container.

 Segment labels override the default behavior.

-| Label                                                                              | Description                                                            |
-|------------------------------------------------------------------------------------|------------------------------------------------------------------------|
-| `traefik.<segment_name>.backend=BACKEND`                                           | Same as `traefik.backend`                                              |
-| `traefik.<segment_name>.domain=DOMAIN`                                             | Same as `traefik.domain`                                               |
-| `traefik.<segment_name>.port=PORT`                                                 | Same as `traefik.port`                                                 |
-| `traefik.<segment_name>.protocol=http`                                             | Same as `traefik.protocol`                                             |
-| `traefik.<segment_name>.weight=10`                                                 | Same as `traefik.weight`                                               |
-| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                  | Same as `traefik.frontend.auth.basic`                                  |
-| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                     | Same as `traefik.frontend.auth.basic.removeHeader`                     |
-| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                            | Same as `traefik.frontend.auth.basic.users`                            |
-| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`             | Same as `traefik.frontend.auth.basic.usersFile`                        |
-| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                    | Same as `traefik.frontend.auth.digest.removeHeader`                    |
-| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                           | Same as `traefik.frontend.auth.digest.users`                           |
-| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`            | Same as `traefik.frontend.auth.digest.usersFile`                       |
-| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`         | Same as `traefik.frontend.auth.forward.address`                        |
-| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`            | Same as `traefik.frontend.auth.forward.authResponseHeaders`            |
-| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                 | Same as `traefik.frontend.auth.forward.tls.ca`                         |
-| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                 | Same as `traefik.frontend.auth.forward.tls.caOptional`                 |
-| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`           | Same as `traefik.frontend.auth.forward.tls.cert`                       |
-| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`         | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`         |
-| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`            | Same as `traefik.frontend.auth.forward.tls.key`                        |
-| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`             | Same as `traefik.frontend.auth.forward.trustForwardHeader`             |
-| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                  | Same as `traefik.frontend.auth.headerField`                            |
-| `traefik.<segment_name>.frontend.entryPoints=https`                                | Same as `traefik.frontend.entryPoints`                                 |
-| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                       | Same as `traefik.frontend.errors.<name>.backend`                       |
-| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                         | Same as `traefik.frontend.errors.<name>.query`                         |
-| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                       | Same as `traefik.frontend.errors.<name>.status`                        |
-| `traefik.<segment_name>.frontend.passHostHeader=true`                              | Same as `traefik.frontend.passHostHeader`                              |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`            | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`            |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`           | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`           |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                | Same as `traefik.frontend.passTLSClientCert.infos.sans`                |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`  | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`  |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`     | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`     |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`    |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`|
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`    |
-| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`| Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`|
-| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                       | Same as `traefik.frontend.passTLSClientCert.infos.pem`                 |
-| `traefik.<segment_name>.frontend.passTLSCert=true`                                 | Same as `traefik.frontend.passTLSCert`                                 |
-| `traefik.<segment_name>.frontend.priority=10`                                      | Same as `traefik.frontend.priority`                                    |
-| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                      | Same as `traefik.frontend.rateLimit.extractorFunc`                     |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`             |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`               | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`            |
-| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                 | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`              |
-| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                        | Same as `traefik.frontend.redirect.entryPoint`                         |
-| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`            | Same as `traefik.frontend.redirect.regex`                              |
-| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`          | Same as `traefik.frontend.redirect.replacement`                        |
-| `traefik.<segment_name>.frontend.redirect.permanent=true`                          | Same as `traefik.frontend.redirect.permanent`                          |
-| `traefik.<segment_name>.frontend.rule=EXP`                                         | Same as `traefik.frontend.rule`                                        |
-| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                      | Same as `traefik.frontend.whiteList.sourceRange`                       |
-| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                  | Same as `traefik.frontend.whiteList.useXForwardedFor`                  |
+| Label                                                                                  | Description                                                                |
+|----------------------------------------------------------------------------------------|----------------------------------------------------------------------------|
+| `traefik.<segment_name>.backend=BACKEND`                                               | Same as `traefik.backend`                                                  |
+| `traefik.<segment_name>.domain=DOMAIN`                                                 | Same as `traefik.domain`                                                   |
+| `traefik.<segment_name>.port=PORT`                                                     | Same as `traefik.port`                                                     |
+| `traefik.<segment_name>.protocol=http`                                                 | Same as `traefik.protocol`                                                 |
+| `traefik.<segment_name>.weight=10`                                                     | Same as `traefik.weight`                                                   |
+| `traefik.<segment_name>.frontend.auth.basic=EXPR`                                      | Same as `traefik.frontend.auth.basic`                                      |
+| `traefik.<segment_name>.frontend.auth.basic.removeHeader=true`                         | Same as `traefik.frontend.auth.basic.removeHeader`                         |
+| `traefik.<segment_name>.frontend.auth.basic.users=EXPR`                                | Same as `traefik.frontend.auth.basic.users`                                |
+| `traefik.<segment_name>.frontend.auth.basic.usersFile=/path/.htpasswd`                 | Same as `traefik.frontend.auth.basic.usersFile`                            |
+| `traefik.<segment_name>.frontend.auth.digest.removeHeader=true`                        | Same as `traefik.frontend.auth.digest.removeHeader`                        |
+| `traefik.<segment_name>.frontend.auth.digest.users=EXPR`                               | Same as `traefik.frontend.auth.digest.users`                               |
+| `traefik.<segment_name>.frontend.auth.digest.usersFile=/path/.htdigest`                | Same as `traefik.frontend.auth.digest.usersFile`                           |
+| `traefik.<segment_name>.frontend.auth.forward.address=https://example.com`             | Same as `traefik.frontend.auth.forward.address`                            |
+| `traefik.<segment_name>.frontend.auth.forward.authResponseHeaders=EXPR`                | Same as `traefik.frontend.auth.forward.authResponseHeaders`                |
+| `traefik.<segment_name>.frontend.auth.forward.tls.ca=/path/ca.pem`                     | Same as `traefik.frontend.auth.forward.tls.ca`                             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.caOptional=true`                     | Same as `traefik.frontend.auth.forward.tls.caOptional`                     |
+| `traefik.<segment_name>.frontend.auth.forward.tls.cert=/path/server.pem`               | Same as `traefik.frontend.auth.forward.tls.cert`                           |
+| `traefik.<segment_name>.frontend.auth.forward.tls.insecureSkipVerify=true`             | Same as `traefik.frontend.auth.forward.tls.insecureSkipVerify`             |
+| `traefik.<segment_name>.frontend.auth.forward.tls.key=/path/server.key`                | Same as `traefik.frontend.auth.forward.tls.key`                            |
+| `traefik.<segment_name>.frontend.auth.forward.trustForwardHeader=true`                 | Same as `traefik.frontend.auth.forward.trustForwardHeader`                 |
+| `traefik.<segment_name>.frontend.auth.headerField=X-WebAuth-User`                      | Same as `traefik.frontend.auth.headerField`                                |
+| `traefik.<segment_name>.frontend.entryPoints=https`                                    | Same as `traefik.frontend.entryPoints`                                     |
+| `traefik.<segment_name>.frontend.errors.<name>.backend=NAME`                           | Same as `traefik.frontend.errors.<name>.backend`                           |
+| `traefik.<segment_name>.frontend.errors.<name>.query=PATH`                             | Same as `traefik.frontend.errors.<name>.query`                             |
+| `traefik.<segment_name>.frontend.errors.<name>.status=RANGE`                           | Same as `traefik.frontend.errors.<name>.status`                            |
+| `traefik.<segment_name>.frontend.passHostHeader=true`                                  | Same as `traefik.frontend.passHostHeader`                                  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.commonName=true`       | Same as `traefik.frontend.passTLSClientCert.infos.issuer.commonName`       |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.country=true`          | Same as `traefik.frontend.passTLSClientCert.infos.issuer.country`          |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.domainComponent=true`  | Same as `traefik.frontend.passTLSClientCert.infos.issuer.domainComponent`  |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.locality=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.locality`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.organization=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.organization`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.province=true`         | Same as `traefik.frontend.passTLSClientCert.infos.issuer.province`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.issuer.serialNumber=true`     | Same as `traefik.frontend.passTLSClientCert.infos.issuer.serialNumber`     |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notAfter=true`                | Same as `traefik.frontend.passTLSClientCert.infos.notAfter`                |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.notBefore=true`               | Same as `traefik.frontend.passTLSClientCert.infos.notBefore`               |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.sans=true`                    | Same as `traefik.frontend.passTLSClientCert.infos.sans`                    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.commonName=true`      | Same as `traefik.frontend.passTLSClientCert.infos.subject.commonName`      |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.country=true`         | Same as `traefik.frontend.passTLSClientCert.infos.subject.country`         |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.domainComponent=true` | Same as `traefik.frontend.passTLSClientCert.infos.subject.domainComponent` |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.locality=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.locality`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.organization=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.organization`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.province=true`        | Same as `traefik.frontend.passTLSClientCert.infos.subject.province`        |
+| `traefik.<segment_name>.frontend.passTLSClientCert.infos.subject.serialNumber=true`    | Same as `traefik.frontend.passTLSClientCert.infos.subject.serialNumber`    |
+| `traefik.<segment_name>.frontend.passTLSClientCert.pem=true`                           | Same as `traefik.frontend.passTLSClientCert.infos.pem`                     |
+| `traefik.<segment_name>.frontend.passTLSCert=true`                                     | Same as `traefik.frontend.passTLSCert`                                     |
+| `traefik.<segment_name>.frontend.priority=10`                                          | Same as `traefik.frontend.priority`                                        |
+| `traefik.<segment_name>.frontend.rateLimit.extractorFunc=EXP`                          | Same as `traefik.frontend.rateLimit.extractorFunc`                         |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.period=6`                    | Same as `traefik.frontend.rateLimit.rateSet.<name>.period`                 |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.average=6`                   | Same as `traefik.frontend.rateLimit.rateSet.<name>.average`                |
+| `traefik.<segment_name>.frontend.rateLimit.rateSet.<name>.burst=6`                     | Same as `traefik.frontend.rateLimit.rateSet.<name>.burst`                  |
+| `traefik.<segment_name>.frontend.redirect.entryPoint=https`                            | Same as `traefik.frontend.redirect.entryPoint`                             |
+| `traefik.<segment_name>.frontend.redirect.regex=^http://localhost/(.*)`                | Same as `traefik.frontend.redirect.regex`                                  |
+| `traefik.<segment_name>.frontend.redirect.replacement=http://mydomain/$1`              | Same as `traefik.frontend.redirect.replacement`                            |
+| `traefik.<segment_name>.frontend.redirect.permanent=true`                              | Same as `traefik.frontend.redirect.permanent`                              |
+| `traefik.<segment_name>.frontend.rule=EXP`                                             | Same as `traefik.frontend.rule`                                            |
+| `traefik.<segment_name>.frontend.whiteList.sourceRange=RANGE`                          | Same as `traefik.frontend.whiteList.sourceRange`                           |
+| `traefik.<segment_name>.frontend.whiteList.useXForwardedFor=true`                      | Same as `traefik.frontend.whiteList.useXForwardedFor`                      |

 #### Custom Headers

--- a/docs/configuration/commons.md
+++ b/docs/configuration/commons.md
@@ -250,7 +250,12 @@ Multiple sets of rates can be added to each frontend, but the time periods must

 In the above example, frontend1 is configured to limit requests by the client's ip address.  
 An average of 5 requests every 3 seconds is allowed and an average of 100 requests every 10 seconds.  
-These can "burst" up to 10 and 200 in each period respectively.
+These can "burst" up to 10 and 200 in each period respectively. 
+
+Valid values for `extractorfunc` are:
+  * `client.ip`
+  * `request.host`
+  * `request.header.<header name>`

 ## Buffering

@@ -528,3 +533,40 @@ Example:
  backend = "{{$backend}}"
 {{end}}
 ```
+
+## Pass TLS Client Cert
+
+```toml
+# Pass the escaped client cert infos selected below in a `X-Forwarded-Ssl-Client-Cert-Infos` header.
+[frontends.frontend1.passTLSClientCert]
+        pem = true
+        [frontends.frontend1.passTLSClientCert.infos]
+            notBefore = true
+            notAfter = true
+            [frontends.frontend1.passTLSClientCert.infos.subject]
+                country = true
+                domainComponent = true
+                province = true
+                locality = true
+                organization = true
+                commonName = true
+                serialNumber = true
+            [frontends.frontend1.passTLSClientCert.infos.issuer]
+                country = true
+                domainComponent = true
+                province = true
+                locality = true
+                organization = true
+                commonName = true
+                serialNumber = true
+```
+
+Pass TLS Client Cert `pem` defines if the escaped pem is added to a `X-Forwarded-Ssl-Client-Cert` header.  
+Pass TLS Client Cert `infos` defines how the certificate data are added to a `X-Forwarded-Ssl-Client-Cert-Infos` header.  
+
+The following example shows an unescaped result that uses all the available fields:
+If there are more than one certificate, they are separated by a `;`
+
+```
+Subject="DC=org,DC=cheese,C=FR,C=US,ST=Cheese org state,ST=Cheese com state,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=*.cheese.com",Issuer="DC=org,DC=cheese,C=FR,C=US,ST=Signing State,ST=Signing State 2,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=Simple Signing CA 2",NB=1544094616,NA=1607166616,SAN=*.cheese.org,*.cheese.net,*.cheese.com,test@cheese.org,test@cheese.net,10.0.1.0,10.0.1.2
+```
--- a/docs/configuration/entrypoints.md
+++ b/docs/configuration/entrypoints.md
@@ -93,7 +93,7 @@ For more information about the CLI, see the documentation about [Traefik command
    Whitespace is used as option separator and `,` is used as value separator for the list.  
    The names of the options are case-insensitive.

-In compose file the entrypoint syntax is different:
+In compose file the entrypoint syntax is different. Notice how quotes are used:

 ```yaml
 traefik:
--- a/docs/configuration/ping.md
+++ b/docs/configuration/ping.md
@@ -30,7 +30,7 @@ Thus, if you have a regular path for `/foo` and an entrypoint on `:80`, you woul
 * Admin panel: `http://hostname:8080/`
 * Ping URL: `http://hostname:8080/ping`

-However, for security reasons, you may want to be able to expose the `/ping` health-check URL to outside health-checkers, e.g. an Internet service or cloud load-balancer, _without_ exposing your administration panel's port.
+However, for security reasons, you may want to be able to expose the `/ping` health-check URL to outside health-checkers, e.g. an Internet service or cloud load-balancer, _without_ exposing your dashboard's port.
 In many environments, the security staff may not _allow_ you to expose it.

 You have two options:
@@ -40,7 +40,7 @@ You have two options:

 ### Ping health check on a regular entry point

-To proxy `/ping` from a regular entry point to the administration one without exposing the panel, do the following:
+To proxy `/ping` from a regular entry point to the administration one without exposing the dashboard, do the following:

 ```toml
 defaultEntryPoints = ["http"]
--- a/docs/configuration/tracing.md
+++ b/docs/configuration/tracing.md
@@ -156,4 +156,10 @@ Traefik supports three tracing backends: Jaeger, Zipkin and DataDog.
    #
    globalTag = ""

+    # Enable priority sampling. When using distributed tracing, this option must be enabled in order
+    # to get all the parts of a distributed trace sampled.
+    #
+    # Default: false
+    #
+    prioritySampling = false
 ```
--- a/docs/index.md
+++ b/docs/index.md
@@ -176,7 +176,7 @@ Our recommendation would be to see for yourself how simple it is to enable HTTPS

 ## Resources

-Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at [GopherCon 2017](https://gophercon.com).
+Here is a talk given by [Emile Vauge](https://github.com/emilevauge) at GopherCon 2017.
 You will learn Traefik basics in less than 10 minutes.

 [![Traefik GopherCon 2017](https://img.youtube.com/vi/RgudiksfL-k/0.jpg)](https://www.youtube.com/watch?v=RgudiksfL-k)
--- a/docs/user-guide/grpc.md
+++ b/docs/user-guide/grpc.md
@@ -14,7 +14,6 @@ defaultEntryPoints = ["https"]
 [entryPoints]
  [entryPoints.http]
  address = ":80"
-    [entryPoints.http]

 [api]

--- a/docs/user-guide/kubernetes.md
+++ b/docs/user-guide/kubernetes.md
@@ -375,6 +375,14 @@ We should now be able to visit [traefik-ui.minikube](http://traefik-ui.minikube)
    For this example to work you need a TLS entrypoint. You don't have to provide a TLS certificate at this point.
    For more details see [here](/configuration/entrypoints/).

+You can add a TLS entrypoint by adding the following `args` to the container spec:
+
+```yaml
+ --defaultentrypoints=http,https
+ --entrypoints=Name:https Address::443 TLS
+ --entrypoints=Name:http Address::80
+```
+    
 To setup an HTTPS-protected ingress, you can leverage the TLS feature of the ingress resource.

 ```yaml
@@ -671,7 +679,7 @@ spec:
 [examples/k8s/cheese-ingress.yaml](https://github.com/containous/traefik/tree/master/examples/k8s/cheese-ingress.yaml)

 !!! note
-    we list each hostname, and add a backend service.
+    We list each hostname, and add a backend service.

 ```shell
 kubectl apply -f https://raw.githubusercontent.com/containous/traefik/master/examples/k8s/cheese-ingress.yaml
@@ -775,11 +783,11 @@ Traefik will now look for cheddar service endpoints (ports on healthy pods) in b
 Deploying cheddar into the cheese namespace and afterwards shutting down cheddar in the default namespace is enough to migrate the traffic.

 !!! note
-   The kubernetes documentation does not specify this merging behavior.
+    The kubernetes documentation does not specify this merging behavior.

 !!! note
-   Merging ingress definitions can cause problems if the annotations differ or if the services handle requests differently.
-   Be careful and extra cautious when running multiple overlapping ingress definitions.
+    Merging ingress definitions can cause problems if the annotations differ or if the services handle requests differently.
+    Be careful and extra cautious when running multiple overlapping ingress definitions.

 ## Specifying Routing Priorities

--- a/docs/user-guide/swarm-mode.md
+++ b/docs/user-guide/swarm-mode.md
@@ -7,7 +7,7 @@ The cluster consists of:
 - 3 servers
 - 1 manager
 - 2 workers
- 1 [overlay](https://docs.docker.com/engine/userguide/networking/dockernetworks/#an-overlay-network) network (multi-host networking)
+- 1 [overlay](https://docs.docker.com/network/overlay/) network (multi-host networking)


 ## Prerequisites
@@ -76,7 +76,7 @@ docker-machine ssh manager "docker network create --driver=overlay traefik-net"
 ## Deploy Traefik

 Let's deploy Traefik as a docker service in our cluster.
-The only requirement for Traefik to work with swarm mode is that it needs to run on a manager node - we are going to use a [constraint](https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints-constraint) for that.
+The only requirement for Traefik to work with swarm mode is that it needs to run on a manager node - we are going to use a [constraint](https://docs.docker.com/engine/reference/commandline/service_create/#specify-service-constraints---constraint) for that.

 ```shell
 docker-machine ssh manager "docker service create \
--- a/docs/user-guide/swarm.md
+++ b/docs/user-guide/swarm.md
@@ -7,7 +7,7 @@ The cluster consists of:
 - 2 servers
 - 1 swarm master
 - 2 swarm nodes
- 1 [overlay](https://docs.docker.com/engine/userguide/networking/dockernetworks/#an-overlay-network) network (multi-host networking)
+- 1 [overlay](https://docs.docker.com/network/overlay/) network (multi-host networking)

 ## Prerequisites

--- a/examples/k8s/traefik-rbac.yaml
+++ b/examples/k8s/traefik-rbac.yaml
@@ -22,6 +22,12 @@ rules:
      - get
      - list
      - watch
+  - apiGroups:
+    - extensions
+    resources:
+    - ingresses/status
+    verbs:
+    - update
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
--- a/examples/quickstart/docker-compose.yml
+++ b/examples/quickstart/docker-compose.yml
@@ -13,6 +13,6 @@ services:

  # A container that exposes a simple API
  whoami:
-    image: emilevauge/whoami  # A container that exposes an API to show it's IP address
+    image: emilevauge/whoami  # A container that exposes an API to show its IP address
    labels:
      - "traefik.frontend.rule=Host:whoami.docker.localhost"
--- a/healthcheck/healthcheck.go
+++ b/healthcheck/healthcheck.go
@@ -58,8 +58,10 @@ type BackendConfig struct {
 }

 func (b *BackendConfig) newRequest(serverURL *url.URL) (*http.Request, error) {
-	u := &url.URL{}
-	*u = *serverURL
+	u, err := serverURL.Parse(b.Path)
+	if err != nil {
+		return nil, err
+	}

 	if len(b.Scheme) > 0 {
 		u.Scheme = b.Scheme
@@ -69,8 +71,6 @@ func (b *BackendConfig) newRequest(serverURL *url.URL) (*http.Request, error) {
 		u.Host = net.JoinHostPort(u.Hostname(), strconv.Itoa(b.Port))
 	}

-	u.Path += b.Path
-
 	return http.NewRequest(http.MethodGet, u.String(), http.NoBody)
 }

--- a/healthcheck/healthcheck_test.go
+++ b/healthcheck/healthcheck_test.go
@@ -150,11 +150,16 @@ func TestSetBackendsConfiguration(t *testing.T) {
 }

 func TestNewRequest(t *testing.T) {
+	type expected struct {
+		err   bool
+		value string
+	}
+
 	testCases := []struct {
 		desc      string
 		serverURL string
 		options   Options
-		expected  string
+		expected  expected
 	}{
 		{
 			desc:      "no port override",
@@ -163,7 +168,10 @@ func TestNewRequest(t *testing.T) {
 				Path: "/test",
 				Port: 0,
 			},
-			expected: "http://backend1:80/test",
+			expected: expected{
+				err:   false,
+				value: "http://backend1:80/test",
+			},
 		},
 		{
 			desc:      "port override",
@@ -172,7 +180,10 @@ func TestNewRequest(t *testing.T) {
 				Path: "/test",
 				Port: 8080,
 			},
-			expected: "http://backend2:8080/test",
+			expected: expected{
+				err:   false,
+				value: "http://backend2:8080/test",
+			},
 		},
 		{
 			desc:      "no port override with no port in server URL",
@@ -181,7 +192,10 @@ func TestNewRequest(t *testing.T) {
 				Path: "/health",
 				Port: 0,
 			},
-			expected: "http://backend1/health",
+			expected: expected{
+				err:   false,
+				value: "http://backend1/health",
+			},
 		},
 		{
 			desc:      "port override with no port in server URL",
@@ -190,7 +204,10 @@ func TestNewRequest(t *testing.T) {
 				Path: "/health",
 				Port: 8080,
 			},
-			expected: "http://backend2:8080/health",
+			expected: expected{
+				err:   false,
+				value: "http://backend2:8080/health",
+			},
 		},
 		{
 			desc:      "scheme override",
@@ -200,7 +217,46 @@ func TestNewRequest(t *testing.T) {
 				Path:   "/test",
 				Port:   0,
 			},
-			expected: "http://backend1:80/test",
+			expected: expected{
+				err:   false,
+				value: "http://backend1:80/test",
+			},
+		},
+		{
+			desc:      "path with param",
+			serverURL: "http://backend1:80",
+			options: Options{
+				Path: "/health?powpow=do",
+				Port: 0,
+			},
+			expected: expected{
+				err:   false,
+				value: "http://backend1:80/health?powpow=do",
+			},
+		},
+		{
+			desc:      "path with params",
+			serverURL: "http://backend1:80",
+			options: Options{
+				Path: "/health?powpow=do&do=powpow",
+				Port: 0,
+			},
+			expected: expected{
+				err:   false,
+				value: "http://backend1:80/health?powpow=do&do=powpow",
+			},
+		},
+		{
+			desc:      "path with invalid path",
+			serverURL: "http://backend1:80",
+			options: Options{
+				Path: ":",
+				Port: 0,
+			},
+			expected: expected{
+				err:   true,
+				value: "",
+			},
 		},
 	}

@@ -211,13 +267,18 @@ func TestNewRequest(t *testing.T) {

 			backend := NewBackendConfig(test.options, "backendName")

-			u, err := url.Parse(test.serverURL)
-			require.NoError(t, err)
+			u := testhelpers.MustParseURL(test.serverURL)

 			req, err := backend.newRequest(u)
-			require.NoError(t, err, "failed to create new backend request")

-			assert.Equal(t, test.expected, req.URL.String())
+			if test.expected.err {
+				require.Error(t, err)
+				assert.Nil(t, nil)
+			} else {
+				require.NoError(t, err, "failed to create new backend request")
+				require.NotNil(t, req)
+				assert.Equal(t, test.expected.value, req.URL.String())
+			}
 		})
 	}
 }
--- a/integration/fixtures/https/https_sni_case_insensitive_dynamic.toml
+++ b/integration/fixtures/https/https_sni_case_insensitive_dynamic.toml
@@ -0,0 +1,37 @@
+logLevel = "DEBUG"
+
+defaultEntryPoints = ["https"]
+
+[entryPoints]
+  [entryPoints.https]
+  address = ":4443"
+    [entryPoints.https.tls]
+     [entryPoints.https.tls.defaultCertificate]
+     certFile = "fixtures/https/wildcard.snitest.com.cert"
+     keyFile = "fixtures/https/wildcard.snitest.com.key"
+
+[api]
+
+[file]
+
+[backends]
+  [backends.backend1]
+    [backends.backend1.servers.server1]
+    url = "http://127.0.0.1:9010"
+    weight = 1
+
+[frontends]
+  [frontends.frontend1]
+  backend = "backend1"
+    [frontends.frontend1.routes.test_1]
+    rule = "HostRegexp: {subdomain:[a-z1-9-]+}.snitest.com"
+  [frontends.frontend2]
+  backend = "backend1"
+    [frontends.frontend2.routes.test_1]
+    rule = "HostRegexp: {subdomain:[a-z1-9-]+}.www.snitest.com"
+
+[[tls]]
+  entryPoints = ["https"]
+  [tls.certificate]
+    certFile = "fixtures/https/uppercase_wildcard.www.snitest.com.cert"
+    keyFile = "fixtures/https/uppercase_wildcard.www.snitest.com.key"
--- a/integration/fixtures/https/https_sni_case_insensitive_static.toml
+++ b/integration/fixtures/https/https_sni_case_insensitive_static.toml
@@ -0,0 +1,34 @@
+logLevel = "DEBUG"
+
+defaultEntryPoints = ["https"]
+
+[entryPoints]
+  [entryPoints.https]
+  address = ":4443"
+    [entryPoints.https.tls]
+     [[entryPoints.https.tls.certificates]]
+     certFile = "fixtures/https/uppercase_wildcard.www.snitest.com.cert"
+     keyFile = "fixtures/https/uppercase_wildcard.www.snitest.com.key"
+     [entryPoints.https.tls.defaultCertificate]
+     certFile = "fixtures/https/wildcard.snitest.com.cert"
+     keyFile = "fixtures/https/wildcard.snitest.com.key"
+
+[api]
+
+[file]
+
+[backends]
+  [backends.backend1]
+    [backends.backend1.servers.server1]
+    url = "http://127.0.0.1:9010"
+    weight = 1
+
+[frontends]
+  [frontends.frontend1]
+  backend = "backend1"
+    [frontends.frontend1.routes.test_1]
+    rule = "HostRegexp: {subdomain:[a-z1-9-]+}.snitest.com"
+  [frontends.frontend2]
+  backend = "backend1"
+    [frontends.frontend2.routes.test_2]
+    rule = "HostRegexp: {subdomain:[a-z1-9-]+}.www.snitest.com"
--- a/integration/fixtures/https/uppercase_wildcard.www.snitest.com.cert
+++ b/integration/fixtures/https/uppercase_wildcard.www.snitest.com.cert
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDDCCAfSgAwIBAgIJAI1YpPACcsQnMA0GCSqGSIb3DQEBCwUAMB4xHDAaBgNV
+BAMME0ZPTy5XV1cuU05JVEVTVC5DT00wHhcNMTgxMDI5MTU1NDI4WhcNMjgxMDI2
+MTU1NDI4WjAeMRwwGgYDVQQDDBNGT08uV1dXLlNOSVRFU1QuQ09NMIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxyWr+1O/tf4yjwhfp3/SDGT5fD0chhGs
+Qc+QM7Ewb5SOmIL5UskxT5pCKc6Kuie5qqEp9xH8Rrfo18iEJQPdhFC1YkaBEI0L
+l1qvN4jmXzAK/E/u4+X+FFprHyruXCmuXqsWQt/qEOqU1ciN47GE9+ZW4R+q70uB
+zrEQ+dzN7IBsyf1lzzS3/TwDgj085QmiZYxKxX40d5hZW6AHxPEKJa2p+Gweqg74
+SpzBWL1DYQLcqHUuMKlbigHg+gleqcO8NiHT5UdeSPVokD5VJPO1La1PMqkLmJYr
+3vVkQ9YzNQ615bX98VMIi17cmE7LE+vz+v287cdFT2f1pNXr3pCGzQIDAQABo00w
+SzALBgNVHQ8EBAMCBDAwCQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAc
+BgNVHREEFTATghEqLldXVy5TTklURVNULkNPTTANBgkqhkiG9w0BAQsFAAOCAQEA
+HJyMCj9oHwECmSGWHnYHkO42zeyj24RKlhNG5skUCqZmpmeDc2BRMYH4fjP75MD2
+kuasZBMAxyQnur/DEn8TzQ1mlKxYCqoza1ql5PkfcwNUp/tvQ7Jhf45Z5mQVeUM7
+RSiBhpeetjHY5/xQb7gXHa97+OjDoRJ6NL/dzGxqypf37kiQPw2jWI5RTFBkP+h/
+sPbeAZJjmiEzvw31SAw9IGj3VvIwcuTxbsdJQITU7hCXDSd1EIocmzAoobY7WRcT
+B1pLmHlP/BaIsM7m0NF/HgUsgo/kgSsxnGA2MHMYQiTImR2DUgrJYzKlJ5acscLK
+sMq9xUnjr6KF1C15R2FpDw==
+-----END CERTIFICATE-----
--- a/integration/fixtures/https/uppercase_wildcard.www.snitest.com.key
+++ b/integration/fixtures/https/uppercase_wildcard.www.snitest.com.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDHJav7U7+1/jKP
+CF+nf9IMZPl8PRyGEaxBz5AzsTBvlI6YgvlSyTFPmkIpzoq6J7mqoSn3EfxGt+jX
+yIQlA92EULViRoEQjQuXWq83iOZfMAr8T+7j5f4UWmsfKu5cKa5eqxZC3+oQ6pTV
+yI3jsYT35lbhH6rvS4HOsRD53M3sgGzJ/WXPNLf9PAOCPTzlCaJljErFfjR3mFlb
+oAfE8Qolran4bB6qDvhKnMFYvUNhAtyodS4wqVuKAeD6CV6pw7w2IdPlR15I9WiQ
+PlUk87UtrU8yqQuYlive9WRD1jM1DrXltf3xUwiLXtyYTssT6/P6/bztx0VPZ/Wk
+1evekIbNAgMBAAECggEAVOFEnTmD47D1oasjAgRj5a5/+6kcaDROJDqwrqeeCmDa
+KjzgwZ1JLDGGc8U5scBOzWAlv83lpcqrLpWjZRdxqfywYrPEPOaxAxC+z7/E2Ntk
+Q0hafL5BfjFPqRgmQhft3yGyukwvuogRadEyUNMP5o1BiHBz7cxUBmHH54dqKZuO
+ueUMgqraJX/GK+Om2rIUst0oOT9yUED+f6ciIjVAmCx1EVxZmX7sxKig10e70eOJ
+rfHlRguJWtxy0+Wl8R8TVrpI5r7qsE8y2fet9RqFOof/4ds8uA2nlZ3NpGkAq3Oo
+65h/2fjD5uQ7jmT+XZcbC7SGhboV42zIrmn0DyNIQKBgQDneeqzMlooNzLD6x+v
+bXo6BJAHXuml440zS5i5RawKc3+/GxGQjBvnfhFH6AQ7cL4ohYyfuAo4srgifRle
+x3Gl8yvFf0uLaQHj811HPWV0fU8bwekI77jmH7WZi2ED/qX7X06R2vvUPGshvJi5
+yPCmJpDQQA6wmxBG1U4SqNw0xQKBgQDcPu2DMAJpbMWWeb5xWv5/6h6TUF4tV7fV
+eIBWuVfe9Jry3gAnb6YUOKYmA5xYJJ+fTz4Nhe4+LQbFS1esT/7ZIATvILogZc3S
+X9+ZCYG/tmDDZvhZqIWWSzzdrjb7dseP1RI4Wp6OnRqHWErrkfzDJKuN15qgW5vR
+FUR2ykV6aQKBgQCv5ZQ00dly3+ciu+QbAb00o0zzXOt91Lnytcp7V3dRhc0YYrBp
+QB7gPYtSMfwtUxIdZsaihE64IQ8NnjSOMk6pRW0Iqh+083mtR7ylKwGSkLpxpFu6
+H7hInuX3pNN3HqXwq87fxSFCeRsLyu3fl9NO3tWCenrvNxYaTXMDeO/E5QKBgE7D
+XlMU/zfOg1bN0PJe1TbPdgG+sv9KKF76CgN5otgD58nE5I812VHP9HMRxX6sEj15
+rDpP1CR+G7bAu+jObtgdIEaYEJf3cES0rpTfFnyF71LR5yzBHIzj+S9Z1yXUk4d3
+bl2i4qMjwdH3HEvkWF09JvDB0vVX7YA3N9W3fmNJAoGBALRi9EbkEBW1vMPwMzps
+YoJ1lp/YyDGTFcg6KFgTfNaOYccb6EXL2Cd21qvDsJw6wthXS+cSqX3qlTLAVLY8
+az/NfyFmW1fUtGjs2s0ZtplStGBhv8VR+2fpt9fgDOOrGYiN2dtmPm7jCAmyQQq7
+JCg7Vq6f0q95DUwiUAo24CBn
+-----END PRIVATE KEY-----
--- a/integration/https_test.go
+++ b/integration/https_test.go
@@ -830,3 +830,71 @@ func (s *HTTPSSuite) TestEntrypointHttpsRedirectAndPathModification(c *check.C)
 		}
 	}
 }
+
+// TestWithSNIStaticCaseInsensitive involves a client sending a SNI hostname of
+// "bar.www.snitest.com", which matches the DNS SAN of '*.WWW.SNITEST.COM'. The test
+// verifies that traefik presents the correct certificate.
+func (s *HTTPSSuite) TestWithSNIStaticCaseInsensitive(c *check.C) {
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/https_sni_case_insensitive_static.toml"))
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for Traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 500*time.Millisecond, try.BodyContains("HostRegexp: {subdomain:[a-z1-9-]+}.www.snitest.com"))
+	c.Assert(err, checker.IsNil)
+
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         "bar.www.snitest.com",
+		NextProtos:         []string{"h2", "http/1.1"},
+	}
+	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
+	c.Assert(err, checker.IsNil, check.Commentf("failed to connect to server"))
+
+	defer conn.Close()
+	err = conn.Handshake()
+	c.Assert(err, checker.IsNil, check.Commentf("TLS handshake error"))
+
+	cs := conn.ConnectionState()
+	err = cs.PeerCertificates[0].VerifyHostname("*.WWW.SNITEST.COM")
+	c.Assert(err, checker.IsNil, check.Commentf("certificate did not match SNI servername"))
+
+	proto := conn.ConnectionState().NegotiatedProtocol
+	c.Assert(proto, checker.Equals, "h2")
+}
+
+// TestWithSNIDynamicCaseInsensitive involves a client sending a SNI hostname of
+// "bar.www.snitest.com", which matches the DNS SAN of '*.WWW.SNITEST.COM'. The test
+// verifies that traefik presents the correct certificate.
+func (s *HTTPSSuite) TestWithSNIDynamicCaseInsensitive(c *check.C) {
+	cmd, display := s.traefikCmd(withConfigFile("fixtures/https/https_sni_case_insensitive_dynamic.toml"))
+	defer display(c)
+	err := cmd.Start()
+	c.Assert(err, checker.IsNil)
+	defer cmd.Process.Kill()
+
+	// wait for Traefik
+	err = try.GetRequest("http://127.0.0.1:8080/api/providers", 500*time.Millisecond, try.BodyContains("HostRegexp: {subdomain:[a-z1-9-]+}.www.snitest.com"))
+	c.Assert(err, checker.IsNil)
+
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         "bar.www.snitest.com",
+		NextProtos:         []string{"h2", "http/1.1"},
+	}
+	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
+	c.Assert(err, checker.IsNil, check.Commentf("failed to connect to server"))
+
+	defer conn.Close()
+	err = conn.Handshake()
+	c.Assert(err, checker.IsNil, check.Commentf("TLS handshake error"))
+
+	cs := conn.ConnectionState()
+	err = cs.PeerCertificates[0].VerifyHostname("*.WWW.SNITEST.COM")
+	c.Assert(err, checker.IsNil, check.Commentf("certificate did not match SNI servername"))
+
+	proto := conn.ConnectionState().NegotiatedProtocol
+	c.Assert(proto, checker.Equals, "h2")
+}
--- a/integration/resources/compose/consul_catalog.yml
+++ b/integration/resources/compose/consul_catalog.yml
@@ -1,5 +1,8 @@
 consul:
-  image: consul
+  # use v1.4.0 because https://github.com/hashicorp/consul/issues/5270
+  # v1.4.1 cannot be used.
+  # waiting for v1.4.2
+  image: consul:1.4.0
  command: agent -server -bootstrap-expect 1 -client 0.0.0.0 -log-level debug -ui
  ports:
    - "8400:8400"
--- a/integration/resources/compose/pebble.yml
+++ b/integration/resources/compose/pebble.yml
@@ -1,5 +1,5 @@
 pebble:
-  image: letsencrypt/pebble:2018-07-27
+  image: letsencrypt/pebble:2018-11-02
  command: pebble --dnsserver ${DOCKER_HOST_IP}:5053
  ports:
    - 14000:14000
--- a/integration/timeout_test.go
+++ b/integration/timeout_test.go
@@ -1,6 +1,7 @@
 package integration

 import (
+	"fmt"
 	"net/http"
 	"os"
 	"time"
@@ -38,6 +39,10 @@ func (s *TimeoutSuite) TestForwardingTimeouts(c *check.C) {
 	c.Assert(err, checker.IsNil)
 	c.Assert(response.StatusCode, checker.Equals, http.StatusGatewayTimeout)

+	// Check that timeout service is available
+	statusURL := fmt.Sprintf("http://%s:9000/statusTest?status=200", httpTimeoutEndpoint)
+	c.Assert(try.GetRequest(statusURL, 60*time.Second, try.StatusCodeIs(http.StatusOK)), checker.IsNil)
+
 	// This simulates a ResponseHeaderTimeout.
 	response, err = http.Get("http://127.0.0.1:8000/responseHeaderTimeout?sleep=1000")
 	c.Assert(err, checker.IsNil)
--- a/middlewares/auth/authenticator.go
+++ b/middlewares/auth/authenticator.go
@@ -134,7 +134,7 @@ func getLinesFromFile(filename string) ([]string, error) {
 	var filteredLines []string
 	for _, rawLine := range rawLines {
 		line := strings.TrimSpace(rawLine)
-		if line != "" {
+		if line != "" && !strings.HasPrefix(line, "#") {
 			filteredLines = append(filteredLines, line)
 		}
 	}
--- a/middlewares/auth/authenticator_test.go
+++ b/middlewares/auth/authenticator_test.go
@@ -45,6 +45,17 @@ func TestAuthUsersFromFile(t *testing.T) {
 				return parserDigestUsers(digest)
 			},
 		},
+		{
+			authType: "basic",
+			usersStr: "#Comment\ntest:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/\ntest2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0\n",
+			userKeys: []string{"test", "test2"},
+			parserFunc: func(fileName string) (map[string]string, error) {
+				basic := &types.Basic{
+					UsersFile: fileName,
+				}
+				return parserBasicUsers(basic)
+			},
+		},
 	}

 	for _, test := range tests {
--- a/middlewares/redirect/redirect.go
+++ b/middlewares/redirect/redirect.go
@@ -125,8 +125,15 @@ type moveHandler struct {
 func (m *moveHandler) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	rw.Header().Set("Location", m.location.String())
 	status := http.StatusFound
+	if req.Method != http.MethodGet {
+		status = http.StatusTemporaryRedirect
+	}
+
 	if m.permanent {
 		status = http.StatusMovedPermanently
+		if req.Method != http.MethodGet {
+			status = http.StatusPermanentRedirect
+		}
 	}
 	rw.WriteHeader(status)
 	rw.Write([]byte(http.StatusText(status)))
--- a/middlewares/redirect/redirect_test.go
+++ b/middlewares/redirect/redirect_test.go
@@ -17,6 +17,7 @@ func TestNewEntryPointHandler(t *testing.T) {
 		desc           string
 		entryPoint     *configuration.EntryPoint
 		permanent      bool
+		method         string
 		url            string
 		expectedURL    string
 		expectedStatus int
@@ -59,6 +60,24 @@ func TestNewEntryPointHandler(t *testing.T) {
 			expectedURL:    "http://foo:80",
 			expectedStatus: http.StatusMovedPermanently,
 		},
+		{
+			desc:           "HTTP to HTTP POST",
+			entryPoint:     &configuration.EntryPoint{Address: ":80"},
+			permanent:      false,
+			url:            "http://foo:90",
+			method:         http.MethodPost,
+			expectedURL:    "http://foo:80",
+			expectedStatus: http.StatusTemporaryRedirect,
+		},
+		{
+			desc:           "HTTP to HTTP POST permanent",
+			entryPoint:     &configuration.EntryPoint{Address: ":80"},
+			permanent:      true,
+			url:            "http://foo:90",
+			method:         http.MethodPost,
+			expectedURL:    "http://foo:80",
+			expectedStatus: http.StatusPermanentRedirect,
+		},
 		{
 			desc:          "invalid address",
 			entryPoint:    &configuration.EntryPoint{Address: ":foo", TLS: &tls.TLS{}},
@@ -80,7 +99,11 @@ func TestNewEntryPointHandler(t *testing.T) {
 				require.NoError(t, err)

 				recorder := httptest.NewRecorder()
-				r := testhelpers.MustNewRequest(http.MethodGet, test.url, nil)
+				method := http.MethodGet
+				if test.method != "" {
+					method = test.method
+				}
+				r := testhelpers.MustNewRequest(method, test.url, nil)
 				handler.ServeHTTP(recorder, r, nil)

 				location, err := recorder.Result().Location()
--- a/middlewares/retry.go
+++ b/middlewares/retry.go
@@ -44,9 +44,7 @@ func (retry *Retry) ServeHTTP(rw http.ResponseWriter, r *http.Request) {

 	attempts := 1
 	for {
-		attemptsExhausted := attempts >= retry.attempts
-
-		shouldRetry := !attemptsExhausted
+		shouldRetry := attempts < retry.attempts
 		retryResponseWriter := newRetryResponseWriter(rw, shouldRetry)

 		// Disable retries when the backend already received request data
@@ -99,6 +97,7 @@ type retryResponseWriter interface {
 func newRetryResponseWriter(rw http.ResponseWriter, shouldRetry bool) retryResponseWriter {
 	responseWriter := &retryResponseWriterWithoutCloseNotify{
 		responseWriter: rw,
+		headers:        make(http.Header),
 		shouldRetry:    shouldRetry,
 	}
 	if _, ok := rw.(http.CloseNotifier); ok {
@@ -109,6 +108,7 @@ func newRetryResponseWriter(rw http.ResponseWriter, shouldRetry bool) retryRespo

 type retryResponseWriterWithoutCloseNotify struct {
 	responseWriter http.ResponseWriter
+	headers        http.Header
 	shouldRetry    bool
 }

@@ -121,10 +121,7 @@ func (rr *retryResponseWriterWithoutCloseNotify) DisableRetries() {
 }

 func (rr *retryResponseWriterWithoutCloseNotify) Header() http.Header {
-	if rr.ShouldRetry() {
-		return make(http.Header)
-	}
-	return rr.responseWriter.Header()
+	return rr.headers
 }

 func (rr *retryResponseWriterWithoutCloseNotify) Write(buf []byte) (int, error) {
@@ -147,6 +144,16 @@ func (rr *retryResponseWriterWithoutCloseNotify) WriteHeader(code int) {
 	if rr.ShouldRetry() {
 		return
 	}
+
+	// In that case retry case is set to false which means we at least managed
+	// to write headers to the backend : we are not going to perform any further retry.
+	// So it is now safe to alter current response headers with headers collected during
+	// the latest try before writing headers to client.
+	headers := rr.responseWriter.Header()
+	for header, value := range rr.headers {
+		headers[header] = value
+	}
+
 	rr.responseWriter.WriteHeader(code)
 }

--- a/middlewares/retry_test.go
+++ b/middlewares/retry_test.go
@@ -1,8 +1,10 @@
 package middlewares

 import (
+	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"net/http/httptrace"
 	"strings"
 	"testing"

@@ -256,3 +258,45 @@ func TestRetryWithFlush(t *testing.T) {
 		t.Errorf("Wrong body %q want %q", responseRecorder.Body.String(), "FULL DATA")
 	}
 }
+
+func TestMultipleRetriesShouldNotLooseHeaders(t *testing.T) {
+	attempt := 0
+	expectedHeaderName := "X-Foo-Test-2"
+	expectedHeaderValue := "bar"
+
+	next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		headerName := fmt.Sprintf("X-Foo-Test-%d", attempt)
+		rw.Header().Add(headerName, expectedHeaderValue)
+		if attempt < 2 {
+			attempt++
+			return
+		}
+
+		// Request has been successfully written to backend
+		trace := httptrace.ContextClientTrace(req.Context())
+		trace.WroteHeaders()
+
+		// And we decide to answer to client
+		rw.WriteHeader(http.StatusNoContent)
+	})
+
+	retry := NewRetry(3, next, &countingRetryListener{})
+	responseRecorder := httptest.NewRecorder()
+	retry.ServeHTTP(responseRecorder, &http.Request{})
+
+	headerValue := responseRecorder.Header().Get(expectedHeaderName)
+
+	// Validate if we have the correct header
+	if headerValue != expectedHeaderValue {
+		t.Errorf("Expected to have %s for header %s, got %s", expectedHeaderValue, expectedHeaderName, headerValue)
+	}
+
+	// Validate that we don't have headers from previous attempts
+	for i := 0; i < attempt; i++ {
+		headerName := fmt.Sprintf("X-Foo-Test-%d", i)
+		headerValue = responseRecorder.Header().Get("headerName")
+		if headerValue != "" {
+			t.Errorf("Expected no value for header %s, got %s", headerName, headerValue)
+		}
+	}
+}
--- a/middlewares/secure.go
+++ b/middlewares/secure.go
@@ -17,6 +17,7 @@ func NewSecure(headers *types.Headers) *secure.Secure {
 		SSLRedirect:             headers.SSLRedirect,
 		SSLTemporaryRedirect:    headers.SSLTemporaryRedirect,
 		SSLHost:                 headers.SSLHost,
+		SSLForceHost:            headers.SSLForceHost,
 		SSLProxyHeaders:         headers.SSLProxyHeaders,
 		STSSeconds:              headers.STSSeconds,
 		STSIncludeSubdomains:    headers.STSIncludeSubdomains,
--- a/middlewares/secure_test.go
+++ b/middlewares/secure_test.go
@@ -0,0 +1,96 @@
+package middlewares
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/containous/traefik/testhelpers"
+	"github.com/containous/traefik/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/unrolled/secure"
+)
+
+func TestSSLForceHost(t *testing.T) {
+	testCases := []struct {
+		desc             string
+		host             string
+		secureMiddleware *secure.Secure
+		expected         int
+	}{
+		{
+			desc: "http should return a 301",
+			host: "http://powpow.example.com",
+			secureMiddleware: NewSecure(&types.Headers{
+				SSLRedirect:  true,
+				SSLForceHost: true,
+				SSLHost:      "powpow.example.com",
+			}),
+			expected: http.StatusMovedPermanently,
+		},
+		{
+			desc: "http sub domain should return a 301",
+			host: "http://www.powpow.example.com",
+			secureMiddleware: NewSecure(&types.Headers{
+				SSLRedirect:  true,
+				SSLForceHost: true,
+				SSLHost:      "powpow.example.com",
+			}),
+			expected: http.StatusMovedPermanently,
+		},
+		{
+			desc: "https should return a 200",
+			host: "https://powpow.example.com",
+			secureMiddleware: NewSecure(&types.Headers{
+				SSLRedirect:  true,
+				SSLForceHost: true,
+				SSLHost:      "powpow.example.com",
+			}),
+			expected: http.StatusOK,
+		},
+		{
+			desc: "https sub domain should return a 301",
+			host: "https://www.powpow.example.com",
+			secureMiddleware: NewSecure(&types.Headers{
+				SSLRedirect:  true,
+				SSLForceHost: true,
+				SSLHost:      "powpow.example.com",
+			}),
+			expected: http.StatusMovedPermanently,
+		},
+		{
+			desc: "http without force host and sub domain should return a 301",
+			host: "http://www.powpow.example.com",
+			secureMiddleware: NewSecure(&types.Headers{
+				SSLRedirect:  true,
+				SSLForceHost: false,
+				SSLHost:      "powpow.example.com",
+			}),
+			expected: http.StatusMovedPermanently,
+		},
+		{
+			desc: "https without force host and sub domain should return a 301",
+			host: "https://www.powpow.example.com",
+			secureMiddleware: NewSecure(&types.Headers{
+				SSLRedirect:  true,
+				SSLForceHost: false,
+				SSLHost:      "powpow.example.com",
+			}),
+			expected: http.StatusOK,
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			req := testhelpers.MustNewRequest(http.MethodGet, test.host, nil)
+			next := func(rw http.ResponseWriter, r *http.Request) {
+				rw.Write([]byte("OK"))
+			}
+
+			rw := httptest.NewRecorder()
+			test.secureMiddleware.HandlerFuncWithNextForRequestOnly(rw, req, next)
+
+			assert.Equal(t, test.expected, rw.Result().StatusCode)
+		})
+	}
+}
--- a/middlewares/tlsClientHeaders.go
+++ b/middlewares/tlsClientHeaders.go
@@ -13,45 +13,54 @@ import (
 	"github.com/containous/traefik/types"
 )

-const xForwardedTLSClientCert = "X-Forwarded-Tls-Client-Cert"
-const xForwardedTLSClientCertInfos = "X-Forwarded-Tls-Client-Cert-Infos"
+const (
+	xForwardedTLSClientCert      = "X-Forwarded-Tls-Client-Cert"
+	xForwardedTLSClientCertInfos = "X-Forwarded-Tls-Client-Cert-Infos"
+)
+
+var attributeTypeNames = map[string]string{
+	"0.9.2342.19200300.100.1.25": "DC", // Domain component OID - RFC 2247
+}

 // TLSClientCertificateInfos is a struct for specifying the configuration for the tlsClientHeaders middleware.
 type TLSClientCertificateInfos struct {
+	Issuer    *DistinguishedNameOptions
 	NotAfter  bool
 	NotBefore bool
-	Subject   *TLSCLientCertificateSubjectInfos
 	Sans      bool
+	Subject   *DistinguishedNameOptions
 }

-// TLSCLientCertificateSubjectInfos contains the configuration for the certificate subject infos.
-type TLSCLientCertificateSubjectInfos struct {
-	Country      bool
-	Province     bool
-	Locality     bool
-	Organization bool
-	CommonName   bool
-	SerialNumber bool
+// DistinguishedNameOptions is a struct for specifying the configuration for the distinguished name info.
+type DistinguishedNameOptions struct {
+	CommonName          bool
+	CountryName         bool
+	DomainComponent     bool
+	LocalityName        bool
+	OrganizationName    bool
+	SerialNumber        bool
+	StateOrProvinceName bool
 }

-// TLSClientHeaders is a middleware that helps setup a few tls infos features.
+// TLSClientHeaders is a middleware that helps setup a few tls info features.
 type TLSClientHeaders struct {
-	PEM   bool                       // pass the sanitized pem to the backend in a specific header
 	Infos *TLSClientCertificateInfos // pass selected informations from the client certificate
+	PEM   bool                       // pass the sanitized pem to the backend in a specific header
 }

-func newTLSCLientCertificateSubjectInfos(infos *types.TLSCLientCertificateSubjectInfos) *TLSCLientCertificateSubjectInfos {
+func newDistinguishedNameOptions(infos *types.TLSCLientCertificateDNInfos) *DistinguishedNameOptions {
 	if infos == nil {
 		return nil
 	}

-	return &TLSCLientCertificateSubjectInfos{
-		SerialNumber: infos.SerialNumber,
-		CommonName:   infos.CommonName,
-		Country:      infos.Country,
-		Locality:     infos.Locality,
-		Organization: infos.Organization,
-		Province:     infos.Province,
+	return &DistinguishedNameOptions{
+		CommonName:          infos.CommonName,
+		CountryName:         infos.Country,
+		DomainComponent:     infos.DomainComponent,
+		LocalityName:        infos.Locality,
+		OrganizationName:    infos.Organization,
+		SerialNumber:        infos.SerialNumber,
+		StateOrProvinceName: infos.Province,
 	}
 }

@@ -61,10 +70,11 @@ func newTLSClientInfos(infos *types.TLSClientCertificateInfos) *TLSClientCertifi
 	}

 	return &TLSClientCertificateInfos{
-		NotBefore: infos.NotBefore,
+		Issuer:    newDistinguishedNameOptions(infos.Issuer),
 		NotAfter:  infos.NotAfter,
+		NotBefore: infos.NotBefore,
 		Sans:      infos.Sans,
-		Subject:   newTLSCLientCertificateSubjectInfos(infos.Subject),
+		Subject:   newDistinguishedNameOptions(infos.Subject),
 	}
 }

@@ -74,18 +84,18 @@ func NewTLSClientHeaders(frontend *types.Frontend) *TLSClientHeaders {
 		return nil
 	}

-	var pem bool
+	var addPEM bool
 	var infos *TLSClientCertificateInfos

 	if frontend.PassTLSClientCert != nil {
 		conf := frontend.PassTLSClientCert
-		pem = conf.PEM
+		addPEM = conf.PEM
 		infos = newTLSClientInfos(conf.Infos)
 	}

 	return &TLSClientHeaders{
-		PEM:   pem,
 		Infos: infos,
+		PEM:   addPEM,
 	}
 }

@@ -153,46 +163,67 @@ func getSANs(cert *x509.Certificate) []string {
 	return append(sans, uris...)
 }

-// getSubjectInfos extract the requested informations from the certificate subject
-func (s *TLSClientHeaders) getSubjectInfos(cs *pkix.Name) string {
-	var subject string
+func getDNInfos(prefix string, options *DistinguishedNameOptions, cs *pkix.Name) string {
+	if options == nil {
+		return ""
+	}

-	if s.Infos != nil && s.Infos.Subject != nil {
-		options := s.Infos.Subject
+	content := &strings.Builder{}

-		var content []string
-
-		if options.Country && len(cs.Country) > 0 {
-			content = append(content, fmt.Sprintf("C=%s", cs.Country[0]))
-		}
-
-		if options.Province && len(cs.Province) > 0 {
-			content = append(content, fmt.Sprintf("ST=%s", cs.Province[0]))
-		}
-
-		if options.Locality && len(cs.Locality) > 0 {
-			content = append(content, fmt.Sprintf("L=%s", cs.Locality[0]))
-		}
-
-		if options.Organization && len(cs.Organization) > 0 {
-			content = append(content, fmt.Sprintf("O=%s", cs.Organization[0]))
-		}
-
-		if options.CommonName && len(cs.CommonName) > 0 {
-			content = append(content, fmt.Sprintf("CN=%s", cs.CommonName))
-		}
-
-		if len(content) > 0 {
-			subject = `Subject="` + strings.Join(content, ",") + `"`
+	// Manage non standard attributes
+	for _, name := range cs.Names {
+		// Domain Component - RFC 2247
+		if options.DomainComponent && attributeTypeNames[name.Type.String()] == "DC" {
+			content.WriteString(fmt.Sprintf("DC=%s,", name.Value))
 		}
 	}

-	return subject
+	if options.CountryName {
+		writeParts(content, cs.Country, "C")
+	}
+
+	if options.StateOrProvinceName {
+		writeParts(content, cs.Province, "ST")
+	}
+
+	if options.LocalityName {
+		writeParts(content, cs.Locality, "L")
+	}
+
+	if options.OrganizationName {
+		writeParts(content, cs.Organization, "O")
+	}
+
+	if options.SerialNumber {
+		writePart(content, cs.SerialNumber, "SN")
+	}
+
+	if options.CommonName {
+		writePart(content, cs.CommonName, "CN")
+	}
+
+	if content.Len() > 0 {
+		return prefix + `="` + strings.TrimSuffix(content.String(), ",") + `"`
+	}
+
+	return ""
 }

-// getXForwardedTLSClientCertInfos Build a string with the wanted client certificates informations
-// like Subject="C=%s,ST=%s,L=%s,O=%s,CN=%s",NB=%d,NA=%d,SAN=%s;
-func (s *TLSClientHeaders) getXForwardedTLSClientCertInfos(certs []*x509.Certificate) string {
+func writeParts(content *strings.Builder, entries []string, prefix string) {
+	for _, entry := range entries {
+		writePart(content, entry, prefix)
+	}
+}
+
+func writePart(content *strings.Builder, entry string, prefix string) {
+	if len(entry) > 0 {
+		content.WriteString(fmt.Sprintf("%s=%s,", prefix, entry))
+	}
+}
+
+// getXForwardedTLSClientCertInfo Build a string with the wanted client certificates informations
+// like Subject="DC=%s,C=%s,ST=%s,L=%s,O=%s,CN=%s",NB=%d,NA=%d,SAN=%s;
+func (s *TLSClientHeaders) getXForwardedTLSClientCertInfo(certs []*x509.Certificate) string {
 	var headerValues []string

 	for _, peerCert := range certs {
@@ -201,9 +232,16 @@ func (s *TLSClientHeaders) getXForwardedTLSClientCertInfos(certs []*x509.Certifi
 		var nb string
 		var na string

-		subject := s.getSubjectInfos(&peerCert.Subject)
-		if len(subject) > 0 {
-			values = append(values, subject)
+		if s.Infos != nil {
+			subject := getDNInfos("Subject", s.Infos.Subject, &peerCert.Subject)
+			if len(subject) > 0 {
+				values = append(values, subject)
+			}
+
+			issuer := getDNInfos("Issuer", s.Infos.Issuer, &peerCert.Issuer)
+			if len(issuer) > 0 {
+				values = append(values, issuer)
+			}
 		}

 		ci := s.Infos
@@ -242,7 +280,7 @@ func (s *TLSClientHeaders) ModifyRequestHeaders(r *http.Request) {

 	if s.Infos != nil {
 		if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
-			headerContent := s.getXForwardedTLSClientCertInfos(r.TLS.PeerCertificates)
+			headerContent := s.getXForwardedTLSClientCertInfo(r.TLS.PeerCertificates)
 			r.Header.Set(xForwardedTLSClientCertInfos, url.QueryEscape(headerContent))
 		} else {
 			log.Warn("Try to extract certificate on a request without TLS")
--- a/middlewares/tlsClientHeaders_test.go
+++ b/middlewares/tlsClientHeaders_test.go
@@ -14,31 +14,232 @@ import (

 	"github.com/containous/traefik/testhelpers"
 	"github.com/containous/traefik/types"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

 const (
-	rootCrt = `-----BEGIN CERTIFICATE-----
-MIIDhjCCAm6gAwIBAgIJAIKZlW9a3VrYMA0GCSqGSIb3DQEBCwUAMFgxCzAJBgNV
-BAYTAkZSMRMwEQYDVQQIDApTb21lLVN0YXRlMREwDwYDVQQHDAhUb3Vsb3VzZTEh
-MB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMB4XDTE4MDcxNzIwMzQz
-OFoXDTE4MDgxNjIwMzQzOFowWDELMAkGA1UEBhMCRlIxEzARBgNVBAgMClNvbWUt
-U3RhdGUxETAPBgNVBAcMCFRvdWxvdXNlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn
-aXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1P8GJ
-H9LkIxIIqK9MyUpushnjmjwccpSMB3OecISKYLy62QDIcAw6NzGcSe8hMwciMJr+
-CdCjJlohybnaRI9hrJ3GPnI++UT/MMthf2IIcjmJxmD4k9L1fgs1V6zSTlo0+o0x
-0gkAGlWvRkgA+3nt555ee84XQZuneKKeRRIlSA1ygycewFobZ/pGYijIEko+gYkV
-sF3LnRGxNl673w+EQsvI7+z29T1nzjmM/xE7WlvnsrVd1/N61jAohLota0YTufwd
-ioJZNryzuPejHBCiQRGMbJ7uEEZLiSCN6QiZEfqhS3AulykjgFXQQHn4zoVljSBR
-UyLV0prIn5Scbks/AgMBAAGjUzBRMB0GA1UdDgQWBBTroRRnSgtkV+8dumtcftb/
-lwIkATAfBgNVHSMEGDAWgBTroRRnSgtkV+8dumtcftb/lwIkATAPBgNVHRMBAf8E
-BTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAJ67U5cLa0ZFa/7zQQT4ldkY6YOEgR
-0LNoTu51hc+ozaXSvF8YIBzkEpEnbGS3x4xodrwEBZjK2LFhNu/33gkCAuhmedgk
-KwZrQM6lqRFGHGVOlkVz+QrJ2EsKYaO4SCUIwVjijXRLA7A30G5C/CIh66PsMgBY
-6QHXVPEWm/v1d1Q/DfFfFzSOa1n1rIUw03qVJsxqSwfwYcegOF8YvS/eH4HUr2gF
-cEujh6CCnylf35ExHa45atr3+xxbOVdNjobISkYADtbhAAn4KjLS4v8W6445vxxj
-G5EIZLjOHyWg1sGaHaaAPkVpZQg8EKm21c4hrEEMfel60AMSSzad/a/V
-----END CERTIFICATE-----`
+	signingCA = `Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Cheese Section, OU=Cheese Section 2, CN=Simple Root CA, CN=Simple Root CA 2, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Root State, ST=Root State 2/emailAddress=root@signing.com/emailAddress=root2@signing.com
+        Validity
+            Not Before: Dec  6 11:10:09 2018 GMT
+            Not After : Dec  5 11:10:09 2028 GMT
+        Subject: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=Simple Signing CA, CN=Simple Signing CA 2, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Signing State, ST=Signing State 2/emailAddress=simple@signing.com/emailAddress=simple2@signing.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (2048 bit)
+                Modulus:
+                    00:c3:9d:9f:61:15:57:3f:78:cc:e7:5d:20:e2:3e:
+                    2e:79:4a:c3:3a:0c:26:40:18:db:87:08:85:c2:f7:
+                    af:87:13:1a:ff:67:8a:b7:2b:58:a7:cc:89:dd:77:
+                    ff:5e:27:65:11:80:82:8f:af:a0:af:25:86:ec:a2:
+                    4f:20:0e:14:15:16:12:d7:74:5a:c3:99:bd:3b:81:
+                    c8:63:6f:fc:90:14:86:d2:39:ee:87:b2:ff:6d:a5:
+                    69:da:ab:5a:3a:97:cd:23:37:6a:4b:ba:63:cd:a1:
+                    a9:e6:79:aa:37:b8:d1:90:c9:24:b5:e8:70:fc:15:
+                    ad:39:97:28:73:47:66:f6:22:79:5a:b0:03:83:8a:
+                    f1:ca:ae:8b:50:1e:c8:fa:0d:9f:76:2e:00:c2:0e:
+                    75:bc:47:5a:b6:d8:05:ed:5a:bc:6d:50:50:36:6b:
+                    ab:ab:69:f6:9b:1b:6c:7e:a8:9f:b2:33:3a:3c:8c:
+                    6d:5e:83:ce:17:82:9e:10:51:a6:39:ec:98:4e:50:
+                    b7:b1:aa:8b:ac:bb:a1:60:1b:ea:31:3b:b8:0a:ea:
+                    63:41:79:b5:ec:ee:19:e9:85:8e:f3:6d:93:80:da:
+                    98:58:a2:40:93:a5:53:eb:1d:24:b6:66:07:ec:58:
+                    10:63:e7:fa:6e:18:60:74:76:15:39:3c:f4:95:95:
+                    7e:df
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE, pathlen:0
+            X509v3 Subject Key Identifier: 
+                1E:52:A2:E8:54:D5:37:EB:D5:A8:1D:E4:C2:04:1D:37:E2:F7:70:03
+            X509v3 Authority Key Identifier: 
+                keyid:36:70:35:AA:F0:F6:93:B2:86:5D:32:73:F9:41:5A:3F:3B:C8:BC:8B
+
+    Signature Algorithm: sha1WithRSAEncryption
+         76:f3:16:21:27:6d:a2:2e:e8:18:49:aa:54:1e:f8:3b:07:fa:
+         65:50:d8:1f:a2:cf:64:6c:15:e0:0f:c8:46:b2:d7:b8:0e:cd:
+         05:3b:06:fb:dd:c6:2f:01:ae:bd:69:d3:bb:55:47:a9:f6:e5:
+         ba:be:4b:45:fb:2e:3c:33:e0:57:d4:3e:8e:3e:11:f2:0a:f1:
+         7d:06:ab:04:2e:a5:76:20:c2:db:a4:68:5a:39:00:62:2a:1d:
+         c2:12:b1:90:66:8c:36:a8:fd:83:d1:1b:da:23:a7:1d:5b:e6:
+         9b:40:c4:78:25:c7:b7:6b:75:35:cf:bb:37:4a:4f:fc:7e:32:
+         1f:8c:cf:12:d2:c9:c8:99:d9:4a:55:0a:1e:ac:de:b4:cb:7c:
+         bf:c4:fb:60:2c:a8:f7:e7:63:5c:b0:1c:62:af:01:3c:fe:4d:
+         3c:0b:18:37:4c:25:fc:d0:b2:f6:b2:f1:c3:f4:0f:53:d6:1e:
+         b5:fa:bc:d8:ad:dd:1c:f5:45:9f:af:fe:0a:01:79:92:9a:d8:
+         71:db:37:f3:1e:bd:fb:c7:1e:0a:0f:97:2a:61:f3:7b:19:93:
+         9c:a6:8a:69:cd:b0:f5:91:02:a5:1b:10:f4:80:5d:42:af:4e:
+         82:12:30:3e:d3:a7:11:14:ce:50:91:04:80:d7:2a:03:ef:71:
+         10:b8:db:a5
+-----BEGIN CERTIFICATE-----
+MIIFzTCCBLWgAwIBAgIBAjANBgkqhkiG9w0BAQUFADCCAWQxEzARBgoJkiaJk/Is
+ZAEZFgNvcmcxFjAUBgoJkiaJk/IsZAEZFgZjaGVlc2UxDzANBgNVBAoMBkNoZWVz
+ZTERMA8GA1UECgwIQ2hlZXNlIDIxFzAVBgNVBAsMDkNoZWVzZSBTZWN0aW9uMRkw
+FwYDVQQLDBBDaGVlc2UgU2VjdGlvbiAyMRcwFQYDVQQDDA5TaW1wbGUgUm9vdCBD
+QTEZMBcGA1UEAwwQU2ltcGxlIFJvb3QgQ0EgMjELMAkGA1UEBhMCRlIxCzAJBgNV
+BAYTAlVTMREwDwYDVQQHDAhUT1VMT1VTRTENMAsGA1UEBwwETFlPTjETMBEGA1UE
+CAwKUm9vdCBTdGF0ZTEVMBMGA1UECAwMUm9vdCBTdGF0ZSAyMR8wHQYJKoZIhvcN
+AQkBFhByb290QHNpZ25pbmcuY29tMSAwHgYJKoZIhvcNAQkBFhFyb290MkBzaWdu
+aW5nLmNvbTAeFw0xODEyMDYxMTEwMDlaFw0yODEyMDUxMTEwMDlaMIIBhDETMBEG
+CgmSJomT8ixkARkWA29yZzEWMBQGCgmSJomT8ixkARkWBmNoZWVzZTEPMA0GA1UE
+CgwGQ2hlZXNlMREwDwYDVQQKDAhDaGVlc2UgMjEfMB0GA1UECwwWU2ltcGxlIFNp
+Z25pbmcgU2VjdGlvbjEhMB8GA1UECwwYU2ltcGxlIFNpZ25pbmcgU2VjdGlvbiAy
+MRowGAYDVQQDDBFTaW1wbGUgU2lnbmluZyBDQTEcMBoGA1UEAwwTU2ltcGxlIFNp
+Z25pbmcgQ0EgMjELMAkGA1UEBhMCRlIxCzAJBgNVBAYTAlVTMREwDwYDVQQHDAhU
+T1VMT1VTRTENMAsGA1UEBwwETFlPTjEWMBQGA1UECAwNU2lnbmluZyBTdGF0ZTEY
+MBYGA1UECAwPU2lnbmluZyBTdGF0ZSAyMSEwHwYJKoZIhvcNAQkBFhJzaW1wbGVA
+c2lnbmluZy5jb20xIjAgBgkqhkiG9w0BCQEWE3NpbXBsZTJAc2lnbmluZy5jb20w
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDnZ9hFVc/eMznXSDiPi55
+SsM6DCZAGNuHCIXC96+HExr/Z4q3K1inzIndd/9eJ2URgIKPr6CvJYbsok8gDhQV
+FhLXdFrDmb07gchjb/yQFIbSOe6Hsv9tpWnaq1o6l80jN2pLumPNoanmeao3uNGQ
+ySS16HD8Fa05lyhzR2b2InlasAODivHKrotQHsj6DZ92LgDCDnW8R1q22AXtWrxt
+UFA2a6urafabG2x+qJ+yMzo8jG1eg84Xgp4QUaY57JhOULexqousu6FgG+oxO7gK
+6mNBebXs7hnphY7zbZOA2phYokCTpVPrHSS2ZgfsWBBj5/puGGB0dhU5PPSVlX7f
+AgMBAAGjZjBkMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0G
+A1UdDgQWBBQeUqLoVNU369WoHeTCBB034vdwAzAfBgNVHSMEGDAWgBQ2cDWq8PaT
+soZdMnP5QVo/O8i8izANBgkqhkiG9w0BAQUFAAOCAQEAdvMWISdtoi7oGEmqVB74
+Owf6ZVDYH6LPZGwV4A/IRrLXuA7NBTsG+93GLwGuvWnTu1VHqfblur5LRfsuPDPg
+V9Q+jj4R8grxfQarBC6ldiDC26RoWjkAYiodwhKxkGaMNqj9g9Eb2iOnHVvmm0DE
+eCXHt2t1Nc+7N0pP/H4yH4zPEtLJyJnZSlUKHqzetMt8v8T7YCyo9+djXLAcYq8B
+PP5NPAsYN0wl/NCy9rLxw/QPU9Yetfq82K3dHPVFn6/+CgF5kprYcds38x69+8ce
+Cg+XKmHzexmTnKaKac2w9ZECpRsQ9IBdQq9OghIwPtOnERTOUJEEgNcqA+9xELjb
+pQ==
+-----END CERTIFICATE-----
+`
+	minimalCheeseCrt = `-----BEGIN CERTIFICATE-----
+MIIEQDCCAygCFFRY0OBk/L5Se0IZRj3CMljawL2UMA0GCSqGSIb3DQEBCwUAMIIB
+hDETMBEGCgmSJomT8ixkARkWA29yZzEWMBQGCgmSJomT8ixkARkWBmNoZWVzZTEP
+MA0GA1UECgwGQ2hlZXNlMREwDwYDVQQKDAhDaGVlc2UgMjEfMB0GA1UECwwWU2lt
+cGxlIFNpZ25pbmcgU2VjdGlvbjEhMB8GA1UECwwYU2ltcGxlIFNpZ25pbmcgU2Vj
+dGlvbiAyMRowGAYDVQQDDBFTaW1wbGUgU2lnbmluZyBDQTEcMBoGA1UEAwwTU2lt
+cGxlIFNpZ25pbmcgQ0EgMjELMAkGA1UEBhMCRlIxCzAJBgNVBAYTAlVTMREwDwYD
+VQQHDAhUT1VMT1VTRTENMAsGA1UEBwwETFlPTjEWMBQGA1UECAwNU2lnbmluZyBT
+dGF0ZTEYMBYGA1UECAwPU2lnbmluZyBTdGF0ZSAyMSEwHwYJKoZIhvcNAQkBFhJz
+aW1wbGVAc2lnbmluZy5jb20xIjAgBgkqhkiG9w0BCQEWE3NpbXBsZTJAc2lnbmlu
+Zy5jb20wHhcNMTgxMjA2MTExMDM2WhcNMjEwOTI1MTExMDM2WjAzMQswCQYDVQQG
+EwJGUjETMBEGA1UECAwKU29tZS1TdGF0ZTEPMA0GA1UECgwGQ2hlZXNlMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAskX/bUtwFo1gF2BTPNaNcTUMaRFu
+FMZozK8IgLjccZ4kZ0R9oFO6Yp8Zl/IvPaf7tE26PI7XP7eHriUdhnQzX7iioDd0
+RZa68waIhAGc+xPzRFrP3b3yj3S2a9Rve3c0K+SCV+EtKAwsxMqQDhoo9PcBfo5B
+RHfht07uD5MncUcGirwN+/pxHV5xzAGPcc7On0/5L7bq/G+63nhu78zw9XyuLaHC
+PM5VbOUvpyIESJHbMMzTdFGL8ob9VKO+Kr1kVGdEA9i8FLGl3xz/GBKuW/JD0xyW
+DrU29mri5vYWHmkuv7ZWHGXnpXjTtPHwveE9/0/ArnmpMyR9JtqFr1oEvQIDAQAB
+MA0GCSqGSIb3DQEBCwUAA4IBAQBHta+NWXI08UHeOkGzOTGRiWXsOH2dqdX6gTe9
+xF1AIjyoQ0gvpoGVvlnChSzmlUj+vnx/nOYGIt1poE3hZA3ZHZD/awsvGyp3GwWD
+IfXrEViSCIyF+8tNNKYyUcEO3xdAsAUGgfUwwF/mZ6MBV5+A/ZEEILlTq8zFt9dV
+vdKzIt7fZYxYBBHFSarl1x8pDgWXlf3hAufevGJXip9xGYmznF0T5cq1RbWJ4be3
+/9K7yuWhuBYC3sbTbCneHBa91M82za+PIISc1ygCYtWSBoZKSAqLk0rkZpHaekDP
+WqeUSNGYV//RunTeuRDAf5OxehERb1srzBXhRZ3cZdzXbgR/
+-----END CERTIFICATE-----
+`
+
+	completeCheeseCrt = `Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+        Signature Algorithm: sha1WithRSAEncryption
+        Issuer: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=Simple Signing CA, CN=Simple Signing CA 2, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Signing State, ST=Signing State 2/emailAddress=simple@signing.com/emailAddress=simple2@signing.com
+        Validity
+            Not Before: Dec  6 11:10:16 2018 GMT
+            Not After : Dec  5 11:10:16 2020 GMT
+        Subject: DC=org, DC=cheese, O=Cheese, O=Cheese 2, OU=Simple Signing Section, OU=Simple Signing Section 2, CN=*.cheese.org, CN=*.cheese.com, C=FR, C=US, L=TOULOUSE, L=LYON, ST=Cheese org state, ST=Cheese com state/emailAddress=cert@cheese.org/emailAddress=cert@scheese.com
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                RSA Public-Key: (2048 bit)
+                Modulus:
+                    00:de:77:fa:8d:03:70:30:39:dd:51:1b:cc:60:db:
+                    a9:5a:13:b1:af:fe:2c:c6:38:9b:88:0a:0f:8e:d9:
+                    1b:a1:1d:af:0d:66:e4:13:5b:bc:5d:36:92:d7:5e:
+                    d0:fa:88:29:d3:78:e1:81:de:98:b2:a9:22:3f:bf:
+                    8a:af:12:92:63:d4:a9:c3:f2:e4:7e:d2:dc:a2:c5:
+                    39:1c:7a:eb:d7:12:70:63:2e:41:47:e0:f0:08:e8:
+                    dc:be:09:01:ec:28:09:af:35:d7:79:9c:50:35:d1:
+                    6b:e5:87:7b:34:f6:d2:31:65:1d:18:42:69:6c:04:
+                    11:83:fe:44:ae:90:92:2d:0b:75:39:57:62:e6:17:
+                    2f:47:2b:c7:53:dd:10:2d:c9:e3:06:13:d2:b9:ba:
+                    63:2e:3c:7d:83:6b:d6:89:c9:cc:9d:4d:bf:9f:e8:
+                    a3:7b:da:c8:99:2b:ba:66:d6:8e:f8:41:41:a0:c9:
+                    d0:5e:c8:11:a4:55:4a:93:83:87:63:04:63:41:9c:
+                    fb:68:04:67:c2:71:2f:f2:65:1d:02:5d:15:db:2c:
+                    d9:04:69:85:c2:7d:0d:ea:3b:ac:85:f8:d4:8f:0f:
+                    c5:70:b2:45:e1:ec:b2:54:0b:e9:f7:82:b4:9b:1b:
+                    2d:b9:25:d4:ab:ca:8f:5b:44:3e:15:dd:b8:7f:b7:
+                    ee:f9
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Key Usage: critical
+                Digital Signature, Key Encipherment
+            X509v3 Basic Constraints: 
+                CA:FALSE
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication, TLS Web Client Authentication
+            X509v3 Subject Key Identifier: 
+                94:BA:73:78:A2:87:FB:58:28:28:CF:98:3B:C2:45:70:16:6E:29:2F
+            X509v3 Authority Key Identifier: 
+                keyid:1E:52:A2:E8:54:D5:37:EB:D5:A8:1D:E4:C2:04:1D:37:E2:F7:70:03
+
+            X509v3 Subject Alternative Name: 
+                DNS:*.cheese.org, DNS:*.cheese.net, DNS:*.cheese.com, IP Address:10.0.1.0, IP Address:10.0.1.2, email:test@cheese.org, email:test@cheese.net
+    Signature Algorithm: sha1WithRSAEncryption
+         76:6b:05:b0:0e:34:11:b1:83:99:91:dc:ae:1b:e2:08:15:8b:
+         16:b2:9b:27:1c:02:ac:b5:df:1b:d0:d0:75:a4:2b:2c:5c:65:
+         ed:99:ab:f7:cd:fe:38:3f:c3:9a:22:31:1b:ac:8c:1c:c2:f9:
+         5d:d4:75:7a:2e:72:c7:85:a9:04:af:9f:2a:cc:d3:96:75:f0:
+         8e:c7:c6:76:48:ac:45:a4:b9:02:1e:2f:c0:15:c4:07:08:92:
+         cb:27:50:67:a1:c8:05:c5:3a:b3:a6:48:be:eb:d5:59:ab:a2:
+         1b:95:30:71:13:5b:0a:9a:73:3b:60:cc:10:d0:6a:c7:e5:d7:
+         8b:2f:f9:2e:98:f2:ff:81:14:24:09:e3:4b:55:57:09:1a:22:
+         74:f1:f6:40:13:31:43:89:71:0a:96:1a:05:82:1f:83:3a:87:
+         9b:17:25:ef:5a:55:f2:2d:cd:0d:4d:e4:81:58:b6:e3:8d:09:
+         62:9a:0c:bd:e4:e5:5c:f0:95:da:cb:c7:34:2c:34:5f:6d:fc:
+         60:7b:12:5b:86:fd:df:21:89:3b:48:08:30:bf:67:ff:8c:e6:
+         9b:53:cc:87:36:47:70:40:3b:d9:90:2a:d2:d2:82:c6:9c:f5:
+         d1:d8:e0:e6:fd:aa:2f:95:7e:39:ac:fc:4e:d4:ce:65:b3:ec:
+         c6:98:8a:31
+-----BEGIN CERTIFICATE-----
+MIIGWjCCBUKgAwIBAgIBATANBgkqhkiG9w0BAQUFADCCAYQxEzARBgoJkiaJk/Is
+ZAEZFgNvcmcxFjAUBgoJkiaJk/IsZAEZFgZjaGVlc2UxDzANBgNVBAoMBkNoZWVz
+ZTERMA8GA1UECgwIQ2hlZXNlIDIxHzAdBgNVBAsMFlNpbXBsZSBTaWduaW5nIFNl
+Y3Rpb24xITAfBgNVBAsMGFNpbXBsZSBTaWduaW5nIFNlY3Rpb24gMjEaMBgGA1UE
+AwwRU2ltcGxlIFNpZ25pbmcgQ0ExHDAaBgNVBAMME1NpbXBsZSBTaWduaW5nIENB
+IDIxCzAJBgNVBAYTAkZSMQswCQYDVQQGEwJVUzERMA8GA1UEBwwIVE9VTE9VU0Ux
+DTALBgNVBAcMBExZT04xFjAUBgNVBAgMDVNpZ25pbmcgU3RhdGUxGDAWBgNVBAgM
+D1NpZ25pbmcgU3RhdGUgMjEhMB8GCSqGSIb3DQEJARYSc2ltcGxlQHNpZ25pbmcu
+Y29tMSIwIAYJKoZIhvcNAQkBFhNzaW1wbGUyQHNpZ25pbmcuY29tMB4XDTE4MTIw
+NjExMTAxNloXDTIwMTIwNTExMTAxNlowggF2MRMwEQYKCZImiZPyLGQBGRYDb3Jn
+MRYwFAYKCZImiZPyLGQBGRYGY2hlZXNlMQ8wDQYDVQQKDAZDaGVlc2UxETAPBgNV
+BAoMCENoZWVzZSAyMR8wHQYDVQQLDBZTaW1wbGUgU2lnbmluZyBTZWN0aW9uMSEw
+HwYDVQQLDBhTaW1wbGUgU2lnbmluZyBTZWN0aW9uIDIxFTATBgNVBAMMDCouY2hl
+ZXNlLm9yZzEVMBMGA1UEAwwMKi5jaGVlc2UuY29tMQswCQYDVQQGEwJGUjELMAkG
+A1UEBhMCVVMxETAPBgNVBAcMCFRPVUxPVVNFMQ0wCwYDVQQHDARMWU9OMRkwFwYD
+VQQIDBBDaGVlc2Ugb3JnIHN0YXRlMRkwFwYDVQQIDBBDaGVlc2UgY29tIHN0YXRl
+MR4wHAYJKoZIhvcNAQkBFg9jZXJ0QGNoZWVzZS5vcmcxHzAdBgkqhkiG9w0BCQEW
+EGNlcnRAc2NoZWVzZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
+AQDed/qNA3AwOd1RG8xg26laE7Gv/izGOJuICg+O2RuhHa8NZuQTW7xdNpLXXtD6
+iCnTeOGB3piyqSI/v4qvEpJj1KnD8uR+0tyixTkceuvXEnBjLkFH4PAI6Ny+CQHs
+KAmvNdd5nFA10Wvlh3s09tIxZR0YQmlsBBGD/kSukJItC3U5V2LmFy9HK8dT3RAt
+yeMGE9K5umMuPH2Da9aJycydTb+f6KN72siZK7pm1o74QUGgydBeyBGkVUqTg4dj
+BGNBnPtoBGfCcS/yZR0CXRXbLNkEaYXCfQ3qO6yF+NSPD8VwskXh7LJUC+n3grSb
+Gy25JdSryo9bRD4V3bh/t+75AgMBAAGjgeAwgd0wDgYDVR0PAQH/BAQDAgWgMAkG
+A1UdEwQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB0GA1UdDgQW
+BBSUunN4oof7WCgoz5g7wkVwFm4pLzAfBgNVHSMEGDAWgBQeUqLoVNU369WoHeTC
+BB034vdwAzBhBgNVHREEWjBYggwqLmNoZWVzZS5vcmeCDCouY2hlZXNlLm5ldIIM
+Ki5jaGVlc2UuY29thwQKAAEAhwQKAAECgQ90ZXN0QGNoZWVzZS5vcmeBD3Rlc3RA
+Y2hlZXNlLm5ldDANBgkqhkiG9w0BAQUFAAOCAQEAdmsFsA40EbGDmZHcrhviCBWL
+FrKbJxwCrLXfG9DQdaQrLFxl7Zmr983+OD/DmiIxG6yMHML5XdR1ei5yx4WpBK+f
+KszTlnXwjsfGdkisRaS5Ah4vwBXEBwiSyydQZ6HIBcU6s6ZIvuvVWauiG5UwcRNb
+CppzO2DMENBqx+XXiy/5Lpjy/4EUJAnjS1VXCRoidPH2QBMxQ4lxCpYaBYIfgzqH
+mxcl71pV8i3NDU3kgVi2440JYpoMveTlXPCV2svHNCw0X238YHsSW4b93yGJO0gI
+ML9n/4zmm1PMhzZHcEA72ZAq0tKCxpz10djg5v2qL5V+Oaz8TtTOZbPsxpiKMQ==
+-----END CERTIFICATE-----
+`

 	minimalCert = `-----BEGIN CERTIFICATE-----
 MIIDGTCCAgECCQCqLd75YLi2kDANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJG
@@ -59,87 +260,6 @@ SBRHc6ojvbqZSJCO0jziGDT1L3D+EDgTjED4nd77v/NRdP+egb0q3P0s4dnQ/5AV
 aQlQADUn61j3ScbGJ4NSeZFFvsl38jeRi/MEzp0bGgNBcPj6JHi7qbbauZcZfQ05
 jECvgAY7Nfd9mZ1KtyNaW31is+kag7NsvjxU/kM=
 -----END CERTIFICATE-----`
-
-	completeCert = `Certificate:
-    Data:
-        Version: 3 (0x2)
-        Serial Number: 3 (0x3)
-    Signature Algorithm: sha1WithRSAEncryption
-        Issuer: C=FR, ST=Some-State, L=Toulouse, O=Internet Widgits Pty Ltd
-        Validity
-            Not Before: Jul 18 08:00:16 2018 GMT
-            Not After : Jul 18 08:00:16 2019 GMT
-        Subject: C=FR, ST=SomeState, L=Toulouse, O=Cheese, CN=*.cheese.org
-        Subject Public Key Info:
-            Public Key Algorithm: rsaEncryption
-                Public-Key: (2048 bit)
-                Modulus:
-                    00:a6:1f:96:7c:c1:cc:b8:1c:b5:91:5d:b8:bf:70:
-                    bc:f7:b8:04:4f:2a:42:de:ea:c5:c3:19:0b:03:04:
-                    ec:ef:a1:24:25:de:ad:05:e7:26:ea:89:6c:59:60:
-                    10:18:0c:73:f1:bf:d3:cc:7b:ed:6b:9c:ea:1d:88:
-                    e2:ee:14:81:d7:07:ee:87:95:3d:36:df:9c:38:b7:
-                    7b:1e:2b:51:9c:4a:1f:d0:cc:5b:af:5d:6c:5c:35:
-                    49:32:e4:01:5b:f9:8c:71:cf:62:48:5a:ea:b7:31:
-                    58:e2:c6:d0:5b:1c:50:b5:5c:6d:5a:6f:da:41:5e:
-                    d5:4c:6e:1a:21:f3:40:f9:9e:52:76:50:25:3e:03:
-                    9b:87:19:48:5b:47:87:d3:67:c6:25:69:77:29:8e:
-                    56:97:45:d9:6f:64:a8:4e:ad:35:75:2e:fc:6a:2e:
-                    47:87:76:fc:4e:3e:44:e9:16:b2:c7:f0:23:98:13:
-                    a2:df:15:23:cb:0c:3d:fd:48:5e:c7:2c:86:70:63:
-                    8b:c6:c8:89:17:52:d5:a7:8e:cb:4e:11:9d:69:8e:
-                    8e:59:cc:7e:a3:bd:a1:11:88:d7:cf:7b:8c:19:46:
-                    9c:1b:7a:c9:39:81:4c:58:08:1f:c7:ce:b0:0e:79:
-                    64:d3:11:72:65:e6:dd:bd:00:7f:22:30:46:9b:66:
-                    9c:b9
-                Exponent: 65537 (0x10001)
-        X509v3 extensions:
-            X509v3 Basic Constraints: 
-                CA:FALSE
-            X509v3 Subject Alternative Name: 
-                DNS:*.cheese.org, DNS:*.cheese.net, DNS:cheese.in, IP Address:10.0.1.0, IP Address:10.0.1.2, email:test@cheese.org, email:test@cheese.net
-            X509v3 Subject Key Identifier: 
-                AB:6B:89:25:11:FC:5E:7B:D4:B0:F7:D4:B6:D9:EB:D0:30:93:E5:58
-    Signature Algorithm: sha1WithRSAEncryption
-         ad:87:84:a0:88:a3:4c:d9:0a:c0:14:e4:2d:9a:1d:bb:57:b7:
-         12:ef:3a:fb:8b:b2:ce:32:b8:04:e6:59:c8:4f:14:6a:b5:12:
-         46:e9:c9:0a:11:64:ea:a1:86:20:96:0e:a7:40:e3:aa:e5:98:
-         91:36:89:77:b6:b9:73:7e:1a:58:19:ae:d1:14:83:1e:c1:5f:
-         a5:a0:32:bb:52:68:b4:8d:a3:1d:b3:08:d7:45:6e:3b:87:64:
-         7e:ef:46:e6:6f:d5:79:d7:1d:57:68:67:d8:18:39:61:5b:8b:
-         1a:7f:88:da:0a:51:9b:3d:6c:5d:b1:cf:b7:e9:1e:06:65:8e:
-         96:d3:61:96:f8:a2:61:f9:40:5e:fa:bc:76:b9:64:0e:6f:90:
-         37:de:ac:6d:7f:36:84:35:19:88:8c:26:af:3e:c3:6a:1a:03:
-         ed:d7:90:89:ed:18:4c:9e:94:1f:d8:ae:6c:61:36:17:72:f9:
-         bb:de:0a:56:9a:79:b4:7d:4a:9d:cb:4a:7d:71:9f:38:e7:8d:
-         f0:87:24:21:0a:24:1f:82:9a:6b:67:ce:7d:af:cb:91:6b:8a:
-         de:e6:d8:6f:a1:37:b9:2d:d0:cb:e8:4e:f4:43:af:ad:90:13:
-         7d:61:7a:ce:86:48:fc:00:8c:37:fb:e0:31:6b:e2:18:ad:fd:
-         1e:df:08:db
-----BEGIN CERTIFICATE-----
-MIIDvTCCAqWgAwIBAgIBAzANBgkqhkiG9w0BAQUFADBYMQswCQYDVQQGEwJGUjET
-MBEGA1UECAwKU29tZS1TdGF0ZTERMA8GA1UEBwwIVG91bG91c2UxITAfBgNVBAoM
-GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODA3MTgwODAwMTZaFw0xOTA3
-MTgwODAwMTZaMFwxCzAJBgNVBAYTAkZSMRIwEAYDVQQIDAlTb21lU3RhdGUxETAP
-BgNVBAcMCFRvdWxvdXNlMQ8wDQYDVQQKDAZDaGVlc2UxFTATBgNVBAMMDCouY2hl
-ZXNlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKYflnzBzLgc
-tZFduL9wvPe4BE8qQt7qxcMZCwME7O+hJCXerQXnJuqJbFlgEBgMc/G/08x77Wuc
-6h2I4u4UgdcH7oeVPTbfnDi3ex4rUZxKH9DMW69dbFw1STLkAVv5jHHPYkha6rcx
-WOLG0FscULVcbVpv2kFe1UxuGiHzQPmeUnZQJT4Dm4cZSFtHh9NnxiVpdymOVpdF
-2W9kqE6tNXUu/GouR4d2/E4+ROkWssfwI5gTot8VI8sMPf1IXscshnBji8bIiRdS
-1aeOy04RnWmOjlnMfqO9oRGI1897jBlGnBt6yTmBTFgIH8fOsA55ZNMRcmXm3b0A
-fyIwRptmnLkCAwEAAaOBjTCBijAJBgNVHRMEAjAAMF4GA1UdEQRXMFWCDCouY2hl
-ZXNlLm9yZ4IMKi5jaGVlc2UubmV0ggljaGVlc2UuaW6HBAoAAQCHBAoAAQKBD3Rl
-c3RAY2hlZXNlLm9yZ4EPdGVzdEBjaGVlc2UubmV0MB0GA1UdDgQWBBSra4klEfxe
-e9Sw99S22evQMJPlWDANBgkqhkiG9w0BAQUFAAOCAQEArYeEoIijTNkKwBTkLZod
-u1e3Eu86+4uyzjK4BOZZyE8UarUSRunJChFk6qGGIJYOp0DjquWYkTaJd7a5c34a
-WBmu0RSDHsFfpaAyu1JotI2jHbMI10VuO4dkfu9G5m/VedcdV2hn2Bg5YVuLGn+I
-2gpRmz1sXbHPt+keBmWOltNhlviiYflAXvq8drlkDm+QN96sbX82hDUZiIwmrz7D
-ahoD7deQie0YTJ6UH9iubGE2F3L5u94KVpp5tH1KnctKfXGfOOeN8IckIQokH4Ka
-a2fOfa/LkWuK3ubYb6E3uS3Qy+hO9EOvrZATfWF6zoZI/ACMN/vgMWviGK39Ht8I
-2w==
-----END CERTIFICATE-----
-`
 )

 func getCleanCertContents(certContents []string) string {
@@ -156,7 +276,7 @@ func getCleanCertContents(certContents []string) string {

 func getCertificate(certContent string) *x509.Certificate {
 	roots := x509.NewCertPool()
-	ok := roots.AppendCertsFromPEM([]byte(rootCrt))
+	ok := roots.AppendCertsFromPEM([]byte(signingCA))
 	if !ok {
 		panic("failed to parse root certificate")
 	}
@@ -202,24 +322,30 @@ func TestSanitize(t *testing.T) {
 		},
 		{
 			desc:       "With a minimal cert",
-			toSanitize: []byte(minimalCert),
-			expected: getExpectedSanitized(`MIIDGTCCAgECCQCqLd75YLi2kDANBgkqhkiG9w0BAQsFADBYMQswCQYDVQQGEwJG
-UjETMBEGA1UECAwKU29tZS1TdGF0ZTERMA8GA1UEBwwIVG91bG91c2UxITAfBgNV
-BAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0xODA3MTgwODI4MTZaFw0x
-ODA4MTcwODI4MTZaMEUxCzAJBgNVBAYTAkZSMRMwEQYDVQQIDApTb21lLVN0YXRl
-MSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3
-DQEBAQUAA4IBDwAwggEKAoIBAQC/+frDMMTLQyXG34F68BPhQq0kzK4LIq9Y0/gl
-FjySZNn1C0QDWA1ubVCAcA6yY204I9cxcQDPNrhC7JlS5QA8Y5rhIBrqQlzZizAi
-Rj3NTrRjtGUtOScnHuJaWjLy03DWD+aMwb7q718xt5SEABmmUvLwQK+EjW2MeDwj
-y8/UEIpvrRDmdhGaqv7IFpIDkcIF7FowJ/hwDvx3PMc+z/JWK0ovzpvgbx69AVbw
-ZxCimeha65rOqVi+lEetD26le+WnOdYsdJ2IkmpPNTXGdfb15xuAc+gFXfMCh7Iw
-3Ynl6dZtZM/Ok2kiA7/OsmVnRKkWrtBfGYkI9HcNGb3zrk6nAgMBAAEwDQYJKoZI
-hvcNAQELBQADggEBAC/R+Yvhh1VUhcbK49olWsk/JKqfS3VIDQYZg1Eo+JCPbwgS
-I1BSYVfMcGzuJTX6ua3m/AHzGF3Tap4GhF4tX12jeIx4R4utnjj7/YKkTvuEM2f4
-xT56YqI7zalGScIB0iMeyNz1QcimRl+M/49au8ow9hNX8C2tcA2cwd/9OIj/6T8q
-SBRHc6ojvbqZSJCO0jziGDT1L3D+EDgTjED4nd77v/NRdP+egb0q3P0s4dnQ/5AV
-aQlQADUn61j3ScbGJ4NSeZFFvsl38jeRi/MEzp0bGgNBcPj6JHi7qbbauZcZfQ05
-jECvgAY7Nfd9mZ1KtyNaW31is+kag7NsvjxU/kM=`),
+			toSanitize: []byte(minimalCheeseCrt),
+			expected: getExpectedSanitized(`MIIEQDCCAygCFFRY0OBk/L5Se0IZRj3CMljawL2UMA0GCSqGSIb3DQEBCwUAMIIB
+hDETMBEGCgmSJomT8ixkARkWA29yZzEWMBQGCgmSJomT8ixkARkWBmNoZWVzZTEP
+MA0GA1UECgwGQ2hlZXNlMREwDwYDVQQKDAhDaGVlc2UgMjEfMB0GA1UECwwWU2lt
+cGxlIFNpZ25pbmcgU2VjdGlvbjEhMB8GA1UECwwYU2ltcGxlIFNpZ25pbmcgU2Vj
+dGlvbiAyMRowGAYDVQQDDBFTaW1wbGUgU2lnbmluZyBDQTEcMBoGA1UEAwwTU2lt
+cGxlIFNpZ25pbmcgQ0EgMjELMAkGA1UEBhMCRlIxCzAJBgNVBAYTAlVTMREwDwYD
+VQQHDAhUT1VMT1VTRTENMAsGA1UEBwwETFlPTjEWMBQGA1UECAwNU2lnbmluZyBT
+dGF0ZTEYMBYGA1UECAwPU2lnbmluZyBTdGF0ZSAyMSEwHwYJKoZIhvcNAQkBFhJz
+aW1wbGVAc2lnbmluZy5jb20xIjAgBgkqhkiG9w0BCQEWE3NpbXBsZTJAc2lnbmlu
+Zy5jb20wHhcNMTgxMjA2MTExMDM2WhcNMjEwOTI1MTExMDM2WjAzMQswCQYDVQQG
+EwJGUjETMBEGA1UECAwKU29tZS1TdGF0ZTEPMA0GA1UECgwGQ2hlZXNlMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAskX/bUtwFo1gF2BTPNaNcTUMaRFu
+FMZozK8IgLjccZ4kZ0R9oFO6Yp8Zl/IvPaf7tE26PI7XP7eHriUdhnQzX7iioDd0
+RZa68waIhAGc+xPzRFrP3b3yj3S2a9Rve3c0K+SCV+EtKAwsxMqQDhoo9PcBfo5B
+RHfht07uD5MncUcGirwN+/pxHV5xzAGPcc7On0/5L7bq/G+63nhu78zw9XyuLaHC
+PM5VbOUvpyIESJHbMMzTdFGL8ob9VKO+Kr1kVGdEA9i8FLGl3xz/GBKuW/JD0xyW
+DrU29mri5vYWHmkuv7ZWHGXnpXjTtPHwveE9/0/ArnmpMyR9JtqFr1oEvQIDAQAB
+MA0GCSqGSIb3DQEBCwUAA4IBAQBHta+NWXI08UHeOkGzOTGRiWXsOH2dqdX6gTe9
+xF1AIjyoQ0gvpoGVvlnChSzmlUj+vnx/nOYGIt1poE3hZA3ZHZD/awsvGyp3GwWD
+IfXrEViSCIyF+8tNNKYyUcEO3xdAsAUGgfUwwF/mZ6MBV5+A/ZEEILlTq8zFt9dV
+vdKzIt7fZYxYBBHFSarl1x8pDgWXlf3hAufevGJXip9xGYmznF0T5cq1RbWJ4be3
+/9K7yuWhuBYC3sbTbCneHBa91M82za+PIISc1ygCYtWSBoZKSAqLk0rkZpHaekDP
+WqeUSNGYV//RunTeuRDAf5OxehERb1srzBXhRZ3cZdzXbgR/`),
 		},
 	}

@@ -228,7 +354,7 @@ jECvgAY7Nfd9mZ1KtyNaW31is+kag7NsvjxU/kM=`),
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

-			require.Equal(t, test.expected, sanitize(test.toSanitize), "The sanitized certificates should be equal")
+			assert.Equal(t, test.expected, sanitize(test.toSanitize), "The sanitized certificates should be equal")
 		})
 	}

@@ -246,7 +372,7 @@ func TestTlsClientheadersWithPEM(t *testing.T) {
 		},
 		{
 			desc:         "TLS, no option",
-			certContents: []string{minimalCert},
+			certContents: []string{minimalCheeseCrt},
 		},
 		{
 			desc:                 "No TLS, with pem option true",
@@ -254,21 +380,21 @@ func TestTlsClientheadersWithPEM(t *testing.T) {
 		},
 		{
 			desc:                 "TLS with simple certificate, with pem option true",
-			certContents:         []string{minimalCert},
+			certContents:         []string{minimalCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
-			expectedHeader:       getCleanCertContents([]string{minimalCert}),
+			expectedHeader:       getCleanCertContents([]string{minimalCheeseCrt}),
 		},
 		{
 			desc:                 "TLS with complete certificate, with pem option true",
-			certContents:         []string{completeCert},
+			certContents:         []string{completeCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
-			expectedHeader:       getCleanCertContents([]string{completeCert}),
+			expectedHeader:       getCleanCertContents([]string{completeCheeseCrt}),
 		},
 		{
 			desc:                 "TLS with two certificate, with pem option true",
-			certContents:         []string{minimalCert, completeCert},
+			certContents:         []string{minimalCheeseCrt, completeCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{PEM: true},
-			expectedHeader:       getCleanCertContents([]string{minimalCert, completeCert}),
+			expectedHeader:       getCleanCertContents([]string{minimalCheeseCrt, completeCheeseCrt}),
 		},
 	}

@@ -292,11 +418,11 @@ func TestTlsClientheadersWithPEM(t *testing.T) {
 			require.Equal(t, "bar", res.Body.String(), "Should be the expected body")

 			if test.expectedHeader != "" {
-				require.Equal(t, getCleanCertContents(test.certContents), req.Header.Get(xForwardedTLSClientCert), "The request header should contain the cleaned certificate")
+				assert.Equal(t, test.expectedHeader, req.Header.Get(xForwardedTLSClientCert), "The request header should contain the cleaned certificate")
 			} else {
-				require.Empty(t, req.Header.Get(xForwardedTLSClientCert))
+				assert.Empty(t, req.Header.Get(xForwardedTLSClientCert))
 			}
-			require.Empty(t, res.Header().Get(xForwardedTLSClientCert), "The response header should be always empty")
+			assert.Empty(t, res.Header().Get(xForwardedTLSClientCert), "The response header should be always empty")
 		})
 	}

@@ -341,10 +467,10 @@ func TestGetSans(t *testing.T) {

 			if len(test.expected) > 0 {
 				for i, expected := range test.expected {
-					require.Equal(t, expected, sans[i])
+					assert.Equal(t, expected, sans[i])
 				}
 			} else {
-				require.Empty(t, sans)
+				assert.Empty(t, sans)
 			}
 		})
 	}
@@ -352,8 +478,8 @@ func TestGetSans(t *testing.T) {
 }

 func TestTlsClientheadersWithCertInfos(t *testing.T) {
-	minimalCertAllInfos := `Subject="C=FR,ST=Some-State,O=Internet Widgits Pty Ltd",NB=1531902496,NA=1534494496,SAN=`
-	completeCertAllInfos := `Subject="C=FR,ST=SomeState,L=Toulouse,O=Cheese,CN=*.cheese.org",NB=1531900816,NA=1563436816,SAN=*.cheese.org,*.cheese.net,cheese.in,test@cheese.org,test@cheese.net,10.0.1.0,10.0.1.2`
+	minimalCheeseCertAllInfos := `Subject="C=FR,ST=Some-State,O=Cheese",Issuer="DC=org,DC=cheese,C=FR,C=US,ST=Signing State,ST=Signing State 2,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=Simple Signing CA 2",NB=1544094636,NA=1632568236,SAN=`
+	completeCertAllInfos := `Subject="DC=org,DC=cheese,C=FR,C=US,ST=Cheese org state,ST=Cheese com state,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=*.cheese.com",Issuer="DC=org,DC=cheese,C=FR,C=US,ST=Signing State,ST=Signing State 2,L=TOULOUSE,L=LYON,O=Cheese,O=Cheese 2,CN=Simple Signing CA 2",NB=1544094616,NA=1607166616,SAN=*.cheese.org,*.cheese.net,*.cheese.com,test@cheese.org,test@cheese.net,10.0.1.0,10.0.1.2`

 	testCases := []struct {
 		desc                 string
@@ -372,7 +498,7 @@ func TestTlsClientheadersWithCertInfos(t *testing.T) {
 			desc: "No TLS, with pem option true",
 			tlsClientCertHeaders: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						CommonName:   true,
 						Organization: true,
 						Locality:     true,
@@ -388,58 +514,81 @@ func TestTlsClientheadersWithCertInfos(t *testing.T) {
 			tlsClientCertHeaders: &types.TLSClientHeaders{
 				PEM: false,
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{},
+					Subject: &types.TLSCLientCertificateDNInfos{},
 				},
 			},
 		},
 		{
 			desc:         "TLS with simple certificate, with all infos",
-			certContents: []string{minimalCert},
+			certContents: []string{minimalCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
 					NotAfter:  true,
 					NotBefore: true,
-					Subject: &types.TLSCLientCertificateSubjectInfos{
-						CommonName:   true,
-						Organization: true,
-						Locality:     true,
-						Province:     true,
-						Country:      true,
-						SerialNumber: true,
+					Subject: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
+					},
+					Issuer: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
 					},
 					Sans: true,
 				},
 			},
-			expectedHeader: url.QueryEscape(minimalCertAllInfos),
+			expectedHeader: url.QueryEscape(minimalCheeseCertAllInfos),
 		},
 		{
 			desc:         "TLS with simple certificate, with some infos",
-			certContents: []string{minimalCert},
+			certContents: []string{minimalCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
 					NotAfter: true,
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						Organization: true,
 					},
+					Issuer: &types.TLSCLientCertificateDNInfos{
+						Country: true,
+					},
 					Sans: true,
 				},
 			},
-			expectedHeader: url.QueryEscape(`Subject="O=Internet Widgits Pty Ltd",NA=1534494496,SAN=`),
+			expectedHeader: url.QueryEscape(`Subject="O=Cheese",Issuer="C=FR,C=US",NA=1632568236,SAN=`),
 		},
 		{
 			desc:         "TLS with complete certificate, with all infos",
-			certContents: []string{completeCert},
+			certContents: []string{completeCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
 					NotAfter:  true,
 					NotBefore: true,
-					Subject: &types.TLSCLientCertificateSubjectInfos{
-						CommonName:   true,
-						Organization: true,
-						Locality:     true,
-						Province:     true,
-						Country:      true,
-						SerialNumber: true,
+					Subject: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
+					},
+					Issuer: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
 					},
 					Sans: true,
 				},
@@ -448,26 +597,35 @@ func TestTlsClientheadersWithCertInfos(t *testing.T) {
 		},
 		{
 			desc:         "TLS with 2 certificates, with all infos",
-			certContents: []string{minimalCert, completeCert},
+			certContents: []string{minimalCheeseCrt, completeCheeseCrt},
 			tlsClientCertHeaders: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
 					NotAfter:  true,
 					NotBefore: true,
-					Subject: &types.TLSCLientCertificateSubjectInfos{
-						CommonName:   true,
-						Organization: true,
-						Locality:     true,
-						Province:     true,
-						Country:      true,
-						SerialNumber: true,
+					Subject: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
+					},
+					Issuer: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
 					},
 					Sans: true,
 				},
 			},
-			expectedHeader: url.QueryEscape(strings.Join([]string{minimalCertAllInfos, completeCertAllInfos}, ";")),
+			expectedHeader: url.QueryEscape(strings.Join([]string{minimalCheeseCertAllInfos, completeCertAllInfos}, ";")),
 		},
 	}
-
 	for _, test := range testCases {
 		tlsClientHeaders := NewTLSClientHeaders(&types.Frontend{PassTLSClientCert: test.tlsClientCertHeaders})

@@ -488,7 +646,13 @@ func TestTlsClientheadersWithCertInfos(t *testing.T) {
 			require.Equal(t, "bar", res.Body.String(), "Should be the expected body")

 			if test.expectedHeader != "" {
-				require.Equal(t, test.expectedHeader, req.Header.Get(xForwardedTLSClientCertInfos), "The request header should contain the cleaned certificate")
+				expected, err := url.QueryUnescape(test.expectedHeader)
+				require.NoError(t, err)
+
+				actual, err2 := url.QueryUnescape(req.Header.Get(xForwardedTLSClientCertInfos))
+				require.NoError(t, err2)
+
+				require.Equal(t, expected, actual, "The request header should contain the cleaned certificate")
 			} else {
 				require.Empty(t, req.Header.Get(xForwardedTLSClientCertInfos))
 			}
@@ -619,7 +783,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							Organization: true,
 						},
 					},
@@ -628,8 +792,8 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			expected: &TLSClientHeaders{
 				PEM: false,
 				Infos: &TLSClientCertificateInfos{
-					Subject: &TLSCLientCertificateSubjectInfos{
-						Organization: true,
+					Subject: &DistinguishedNameOptions{
+						OrganizationName: true,
 					},
 				},
 			},
@@ -639,7 +803,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							Country: true,
 						},
 					},
@@ -648,8 +812,8 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			expected: &TLSClientHeaders{
 				PEM: false,
 				Infos: &TLSClientCertificateInfos{
-					Subject: &TLSCLientCertificateSubjectInfos{
-						Country: true,
+					Subject: &DistinguishedNameOptions{
+						CountryName: true,
 					},
 				},
 			},
@@ -659,7 +823,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							SerialNumber: true,
 						},
 					},
@@ -668,7 +832,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			expected: &TLSClientHeaders{
 				PEM: false,
 				Infos: &TLSClientCertificateInfos{
-					Subject: &TLSCLientCertificateSubjectInfos{
+					Subject: &DistinguishedNameOptions{
 						SerialNumber: true,
 					},
 				},
@@ -679,7 +843,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							Province: true,
 						},
 					},
@@ -688,8 +852,8 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			expected: &TLSClientHeaders{
 				PEM: false,
 				Infos: &TLSClientCertificateInfos{
-					Subject: &TLSCLientCertificateSubjectInfos{
-						Province: true,
+					Subject: &DistinguishedNameOptions{
+						StateOrProvinceName: true,
 					},
 				},
 			},
@@ -699,7 +863,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							Locality: true,
 						},
 					},
@@ -708,8 +872,8 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			expected: &TLSClientHeaders{
 				PEM: false,
 				Infos: &TLSClientCertificateInfos{
-					Subject: &TLSCLientCertificateSubjectInfos{
-						Locality: true,
+					Subject: &DistinguishedNameOptions{
+						LocalityName: true,
 					},
 				},
 			},
@@ -719,7 +883,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							CommonName: true,
 						},
 					},
@@ -728,14 +892,46 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 			expected: &TLSClientHeaders{
 				PEM: false,
 				Infos: &TLSClientCertificateInfos{
-					Subject: &TLSCLientCertificateSubjectInfos{
+					Subject: &DistinguishedNameOptions{
 						CommonName: true,
 					},
 				},
 			},
 		},
 		{
-			desc: "frontend with the Infos NotBefore",
+			desc: "frontend with the Infos Issuer",
+			frontend: &types.Frontend{
+				PassTLSClientCert: &types.TLSClientHeaders{
+					Infos: &types.TLSClientCertificateInfos{
+						Issuer: &types.TLSCLientCertificateDNInfos{
+							CommonName:      true,
+							Country:         true,
+							DomainComponent: true,
+							Locality:        true,
+							Organization:    true,
+							SerialNumber:    true,
+							Province:        true,
+						},
+					},
+				},
+			},
+			expected: &TLSClientHeaders{
+				PEM: false,
+				Infos: &TLSClientCertificateInfos{
+					Issuer: &DistinguishedNameOptions{
+						CommonName:          true,
+						CountryName:         true,
+						DomainComponent:     true,
+						LocalityName:        true,
+						OrganizationName:    true,
+						SerialNumber:        true,
+						StateOrProvinceName: true,
+					},
+				},
+			},
+		},
+		{
+			desc: "frontend with the Sans Infos",
 			frontend: &types.Frontend{
 				PassTLSClientCert: &types.TLSClientHeaders{
 					Infos: &types.TLSClientCertificateInfos{
@@ -757,7 +953,7 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 					Infos: &types.TLSClientCertificateInfos{
 						NotAfter:  true,
 						NotBefore: true,
-						Subject: &types.TLSCLientCertificateSubjectInfos{
+						Subject: &types.TLSCLientCertificateDNInfos{
 							CommonName:   true,
 							Country:      true,
 							Locality:     true,
@@ -765,6 +961,14 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 							Province:     true,
 							SerialNumber: true,
 						},
+						Issuer: &types.TLSCLientCertificateDNInfos{
+							Country:         true,
+							DomainComponent: true,
+							Locality:        true,
+							Organization:    true,
+							SerialNumber:    true,
+							Province:        true,
+						},
 						Sans: true,
 					},
 				},
@@ -775,13 +979,21 @@ func TestNewTLSClientHeadersFromStruct(t *testing.T) {
 					NotBefore: true,
 					NotAfter:  true,
 					Sans:      true,
-					Subject: &TLSCLientCertificateSubjectInfos{
-						Province:     true,
-						Organization: true,
-						Locality:     true,
-						Country:      true,
-						CommonName:   true,
-						SerialNumber: true,
+					Subject: &DistinguishedNameOptions{
+						CountryName:         true,
+						StateOrProvinceName: true,
+						LocalityName:        true,
+						OrganizationName:    true,
+						CommonName:          true,
+						SerialNumber:        true,
+					},
+					Issuer: &DistinguishedNameOptions{
+						CountryName:         true,
+						DomainComponent:     true,
+						LocalityName:        true,
+						OrganizationName:    true,
+						SerialNumber:        true,
+						StateOrProvinceName: true,
 					},
 				}},
 		},
--- a/middlewares/tracing/datadog/datadog.go
+++ b/middlewares/tracing/datadog/datadog.go
@@ -18,6 +18,7 @@ type Config struct {
 	LocalAgentHostPort string `description:"Set datadog-agent's host:port that the reporter will used. Defaults to localhost:8126" export:"false"`
 	GlobalTag          string `description:"Key:Value tag to be set on all the spans." export:"true"`
 	Debug              bool   `description:"Enable DataDog debug." export:"true"`
+	PrioritySampling   bool   `description:"Enable priority sampling. When using distributed tracing, this option must be enabled in order to get all the parts of a distributed trace sampled."`
 }

 // Setup sets up the tracer
@@ -29,12 +30,16 @@ func (c *Config) Setup(serviceName string) (opentracing.Tracer, io.Closer, error
 		value = tag[1]
 	}

-	tracer := ddtracer.New(
+	opts := []datadog.StartOption{
 		datadog.WithAgentAddr(c.LocalAgentHostPort),
 		datadog.WithServiceName(serviceName),
 		datadog.WithGlobalTag(tag[0], value),
 		datadog.WithDebugMode(c.Debug),
-	)
+	}
+	if c.PrioritySampling {
+		opts = append(opts, datadog.WithPrioritySampling())
+	}
+	tracer := ddtracer.New(opts...)

 	// Without this, child spans are getting the NOOP tracer
 	opentracing.SetGlobalTracer(tracer)
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -25,7 +25,7 @@ theme:
    prev: 'Previous'
    next: 'Next'

-copyright: "Copyright &copy; 2016-2018 Containous SAS"
+copyright: "Copyright &copy; 2016-2019 Containous"

 google_analytics:
  - 'UA-51880359-3'
--- a/provider/acme/account.go
+++ b/provider/acme/account.go
@@ -7,15 +7,16 @@ import (
 	"crypto/x509"

 	"github.com/containous/traefik/log"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/certcrypto"
+	"github.com/xenolf/lego/registration"
 )

 // Account is used to store lets encrypt registration info
 type Account struct {
 	Email        string
-	Registration *acme.RegistrationResource
+	Registration *registration.Resource
 	PrivateKey   []byte
-	KeyType      acme.KeyType
+	KeyType      certcrypto.KeyType
 }

 const (
@@ -46,7 +47,7 @@ func (a *Account) GetEmail() string {
 }

 // GetRegistration returns lets encrypt registration resource
-func (a *Account) GetRegistration() *acme.RegistrationResource {
+func (a *Account) GetRegistration() *registration.Resource {
 	return a.Registration
 }

@@ -61,23 +62,23 @@ func (a *Account) GetPrivateKey() crypto.PrivateKey {
 }

 // GetKeyType used to determine which algo to used
-func GetKeyType(value string) acme.KeyType {
+func GetKeyType(value string) certcrypto.KeyType {
 	switch value {
 	case "EC256":
-		return acme.EC256
+		return certcrypto.EC256
 	case "EC384":
-		return acme.EC384
+		return certcrypto.EC384
 	case "RSA2048":
-		return acme.RSA2048
+		return certcrypto.RSA2048
 	case "RSA4096":
-		return acme.RSA4096
+		return certcrypto.RSA4096
 	case "RSA8192":
-		return acme.RSA8192
+		return certcrypto.RSA8192
 	case "":
-		log.Infof("The key type is empty. Use default key type %v.", acme.RSA4096)
-		return acme.RSA4096
+		log.Infof("The key type is empty. Use default key type %v.", certcrypto.RSA4096)
+		return certcrypto.RSA4096
 	default:
-		log.Infof("Unable to determine key type value %q. Use default key type %v.", value, acme.RSA4096)
-		return acme.RSA4096
+		log.Infof("Unable to determine key type value %q. Use default key type %v.", value, certcrypto.RSA4096)
+		return certcrypto.RSA4096
 	}
 }
--- a/provider/acme/challenge_http.go
+++ b/provider/acme/challenge_http.go
@@ -9,10 +9,11 @@ import (
 	"github.com/containous/mux"
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/safe"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/challenge"
+	"github.com/xenolf/lego/challenge/http01"
 )

-var _ acme.ChallengeProviderTimeout = (*challengeHTTP)(nil)
+var _ challenge.ProviderTimeout = (*challengeHTTP)(nil)

 type challengeHTTP struct {
 	Store Store
@@ -61,7 +62,7 @@ func getTokenValue(token, domain string, store Store) []byte {
 // AddRoutes add routes on internal router
 func (p *Provider) AddRoutes(router *mux.Router) {
 	router.Methods(http.MethodGet).
-		Path(acme.HTTP01ChallengePath("{token}")).
+		Path(http01.ChallengePath("{token}")).
 		Handler(http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 			vars := mux.Vars(req)
 			if token, ok := vars["token"]; ok {
--- a/provider/acme/challenge_tls.go
+++ b/provider/acme/challenge_tls.go
@@ -5,10 +5,11 @@ import (

 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/types"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/challenge"
+	"github.com/xenolf/lego/challenge/tlsalpn01"
 )

-var _ acme.ChallengeProvider = (*challengeTLSALPN)(nil)
+var _ challenge.Provider = (*challengeTLSALPN)(nil)

 type challengeTLSALPN struct {
 	Store Store
@@ -17,7 +18,7 @@ type challengeTLSALPN struct {
 func (c *challengeTLSALPN) Present(domain, token, keyAuth string) error {
 	log.Debugf("TLS Challenge Present temp certificate for %s", domain)

-	certPEMBlock, keyPEMBlock, err := acme.TLSALPNChallengeBlocks(domain, keyAuth)
+	certPEMBlock, keyPEMBlock, err := tlsalpn01.ChallengeBlocks(domain, keyAuth)
 	if err != nil {
 		return err
 	}
--- a/provider/acme/provider.go
+++ b/provider/acme/provider.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io/ioutil"
 	fmtlog "log"
-	"net"
 	"net/url"
 	"reflect"
 	"strings"
@@ -23,9 +22,13 @@ import (
 	"github.com/containous/traefik/version"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/certificate"
+	"github.com/xenolf/lego/challenge"
+	"github.com/xenolf/lego/challenge/dns01"
+	"github.com/xenolf/lego/lego"
 	legolog "github.com/xenolf/lego/log"
 	"github.com/xenolf/lego/providers/dns"
+	"github.com/xenolf/lego/registration"
 )

 var (
@@ -55,7 +58,7 @@ type Provider struct {
 	Store                  Store
 	certificates           []*Certificate
 	account                *Account
-	client                 *acme.Client
+	client                 *lego.Client
 	certsChan              chan *Certificate
 	configurationChan      chan<- types.ConfigMessage
 	certificateStore       *traefiktls.CertificateStore
@@ -113,14 +116,13 @@ func (p *Provider) ListenRequest(domain string) (*tls.Certificate, error) {
 		return nil, err
 	}

-	certificate, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)
+	cert, err := tls.X509KeyPair(acmeCert.Certificate, acmeCert.PrivateKey)

-	return &certificate, err
+	return &cert, err
 }

 // Init for compatibility reason the BaseProvider implements an empty Init
 func (p *Provider) Init(_ types.Constraints) error {
-	acme.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
 	if p.ACMELogging {
 		legolog.Logger = fmtlog.New(log.WriterLevel(logrus.InfoLevel), "legolog: ", 0)
 	} else {
@@ -207,7 +209,7 @@ func (p *Provider) Provide(configurationChan chan<- types.ConfigMessage, pool *s
 	return nil
 }

-func (p *Provider) getClient() (*acme.Client, error) {
+func (p *Provider) getClient() (*lego.Client, error) {
 	p.clientMutex.Lock()
 	defer p.clientMutex.Unlock()

@@ -228,7 +230,12 @@ func (p *Provider) getClient() (*acme.Client, error) {
 	}
 	log.Debug(caServer)

-	client, err := acme.NewClient(caServer, account, account.KeyType)
+	config := lego.NewConfig(account)
+	config.CADirURL = caServer
+	config.Certificate.KeyType = account.KeyType
+	config.UserAgent = fmt.Sprintf("containous-traefik/%s", version.Version)
+
+	client, err := lego.NewClient(config)
 	if err != nil {
 		return nil, err
 	}
@@ -237,7 +244,7 @@ func (p *Provider) getClient() (*acme.Client, error) {
 	if account.GetRegistration() == nil {
 		log.Info("Register...")

-		reg, err := client.Register(true)
+		reg, err := client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
 		if err != nil {
 			return nil, err
 		}
@@ -255,23 +262,23 @@ func (p *Provider) getClient() (*acme.Client, error) {
 	if p.DNSChallenge != nil && len(p.DNSChallenge.Provider) > 0 {
 		log.Debugf("Using DNS Challenge provider: %s", p.DNSChallenge.Provider)

-		SetRecursiveNameServers(p.DNSChallenge.Resolvers)
-		SetPropagationCheck(p.DNSChallenge.DisablePropagationCheck)
-
-		err = dnsOverrideDelay(p.DNSChallenge.DelayBeforeCheck)
-		if err != nil {
-			return nil, err
-		}
-
-		var provider acme.ChallengeProvider
+		var provider challenge.Provider
 		provider, err = dns.NewDNSChallengeProviderByName(p.DNSChallenge.Provider)
 		if err != nil {
 			return nil, err
 		}

-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.TLSALPN01})
-
-		err = client.SetChallengeProvider(acme.DNS01, provider)
+		err = client.Challenge.SetDNS01Provider(provider,
+			dns01.CondOption(len(p.DNSChallenge.Resolvers) > 0, dns01.AddRecursiveNameservers(p.DNSChallenge.Resolvers)),
+			dns01.CondOption(p.DNSChallenge.DisablePropagationCheck || p.DNSChallenge.DelayBeforeCheck > 0,
+				dns01.AddPreCheck(func(_, _ string) (bool, error) {
+					if p.DNSChallenge.DelayBeforeCheck > 0 {
+						log.Debugf("Delaying %d rather than validating DNS propagation now.", p.DNSChallenge.DelayBeforeCheck)
+						time.Sleep(time.Duration(p.DNSChallenge.DelayBeforeCheck))
+					}
+					return true, nil
+				})),
+		)
 		if err != nil {
 			return nil, err
 		}
@@ -281,25 +288,21 @@ func (p *Provider) getClient() (*acme.Client, error) {
 		p.DNSChallenge.preCheckInterval = 2 * time.Second

 		// Set the precheck timeout into the DNSChallenge provider
-		if challengeProviderTimeout, ok := provider.(acme.ChallengeProviderTimeout); ok {
+		if challengeProviderTimeout, ok := provider.(challenge.ProviderTimeout); ok {
 			p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval = challengeProviderTimeout.Timeout()
 		}

 	} else if p.HTTPChallenge != nil && len(p.HTTPChallenge.EntryPoint) > 0 {
 		log.Debug("Using HTTP Challenge provider.")

-		client.ExcludeChallenges([]acme.Challenge{acme.DNS01, acme.TLSALPN01})
-
-		err = client.SetChallengeProvider(acme.HTTP01, &challengeHTTP{Store: p.Store})
+		err = client.Challenge.SetHTTP01Provider(&challengeHTTP{Store: p.Store})
 		if err != nil {
 			return nil, err
 		}
 	} else if p.TLSChallenge != nil {
 		log.Debug("Using TLS Challenge provider.")

-		client.ExcludeChallenges([]acme.Challenge{acme.HTTP01, acme.DNS01})
-
-		err = client.SetChallengeProvider(acme.TLSALPN01, &challengeTLSALPN{Store: p.Store})
+		err = client.Challenge.SetTLSALPN01Provider(&challengeTLSALPN{Store: p.Store})
 		if err != nil {
 			return nil, err
 		}
@@ -383,7 +386,7 @@ func (p *Provider) watchNewDomains() {
 	})
 }

-func (p *Provider) resolveCertificate(domain types.Domain, domainFromConfigurationFile bool) (*acme.CertificateResource, error) {
+func (p *Provider) resolveCertificate(domain types.Domain, domainFromConfigurationFile bool) (*certificate.Resource, error) {
 	domains, err := p.getValidDomains(domain, domainFromConfigurationFile)
 	if err != nil {
 		return nil, err
@@ -405,22 +408,27 @@ func (p *Provider) resolveCertificate(domain types.Domain, domainFromConfigurati
 		return nil, fmt.Errorf("cannot get ACME client %v", err)
 	}

-	var certificate *acme.CertificateResource
+	var cert *certificate.Resource
 	bundle := true
 	if p.useCertificateWithRetry(uncheckedDomains) {
-		certificate, err = obtainCertificateWithRetry(domains, client, p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval, bundle)
+		cert, err = obtainCertificateWithRetry(domains, client, p.DNSChallenge.preCheckTimeout, p.DNSChallenge.preCheckInterval, bundle)
 	} else {
-		certificate, err = client.ObtainCertificate(domains, bundle, nil, OSCPMustStaple)
+		request := certificate.ObtainRequest{
+			Domains:    domains,
+			Bundle:     bundle,
+			MustStaple: OSCPMustStaple,
+		}
+		cert, err = client.Certificate.Obtain(request)
 	}

 	if err != nil {
 		return nil, fmt.Errorf("unable to generate a certificate for the domains %v: %v", uncheckedDomains, err)
 	}
-	if certificate == nil {
+	if cert == nil {
 		return nil, fmt.Errorf("domains %v do not generate a certificate", uncheckedDomains)
 	}
-	if len(certificate.Certificate) == 0 || len(certificate.PrivateKey) == 0 {
-		return nil, fmt.Errorf("domains %v generate certificate with no value: %v", uncheckedDomains, certificate)
+	if len(cert.Certificate) == 0 || len(cert.PrivateKey) == 0 {
+		return nil, fmt.Errorf("domains %v generate certificate with no value: %v", uncheckedDomains, cert)
 	}

 	log.Debugf("Certificates obtained for domains %+v", uncheckedDomains)
@@ -430,9 +438,9 @@ func (p *Provider) resolveCertificate(domain types.Domain, domainFromConfigurati
 	} else {
 		domain = types.Domain{Main: uncheckedDomains[0]}
 	}
-	p.addCertificateForDomain(domain, certificate.Certificate, certificate.PrivateKey)
+	p.addCertificateForDomain(domain, cert.Certificate, cert.PrivateKey)

-	return certificate, nil
+	return cert, nil
 }

 func (p *Provider) removeResolvingDomains(resolvingDomains []string) {
@@ -479,12 +487,17 @@ func (p *Provider) useCertificateWithRetry(domains []string) bool {
 	return false
 }

-func obtainCertificateWithRetry(domains []string, client *acme.Client, timeout, interval time.Duration, bundle bool) (*acme.CertificateResource, error) {
-	var certificate *acme.CertificateResource
+func obtainCertificateWithRetry(domains []string, client *lego.Client, timeout, interval time.Duration, bundle bool) (*certificate.Resource, error) {
+	var cert *certificate.Resource
 	var err error

 	operation := func() error {
-		certificate, err = client.ObtainCertificate(domains, bundle, nil, OSCPMustStaple)
+		request := certificate.ObtainRequest{
+			Domains:    domains,
+			Bundle:     bundle,
+			MustStaple: OSCPMustStaple,
+		}
+		cert, err = client.Certificate.Obtain(request)
 		return err
 	}

@@ -504,25 +517,7 @@ func obtainCertificateWithRetry(domains []string, client *acme.Client, timeout,
 		return nil, err
 	}

-	return certificate, nil
-}
-
-func dnsOverrideDelay(delay flaeg.Duration) error {
-	if delay == 0 {
-		return nil
-	}
-
-	if delay > 0 {
-		log.Debugf("Delaying %d rather than validating DNS propagation now.", delay)
-
-		acme.PreCheckDNS = func(_, _ string) (bool, error) {
-			time.Sleep(time.Duration(delay))
-			return true, nil
-		}
-	} else {
-		return fmt.Errorf("delayBeforeCheck: %d cannot be less than 0", delay)
-	}
-	return nil
+	return cert, nil
 }

 func (p *Provider) addCertificateForDomain(domain types.Domain, certificate []byte, key []byte) {
@@ -634,44 +629,44 @@ func (p *Provider) refreshCertificates() {
 	}

 	for _, cert := range p.certificates {
-		certificate := &traefiktls.Certificate{CertFile: traefiktls.FileOrContent(cert.Certificate), KeyFile: traefiktls.FileOrContent(cert.Key)}
-		config.Configuration.TLS = append(config.Configuration.TLS, &traefiktls.Configuration{Certificate: certificate, EntryPoints: []string{p.EntryPoint}})
+		cert := &traefiktls.Certificate{CertFile: traefiktls.FileOrContent(cert.Certificate), KeyFile: traefiktls.FileOrContent(cert.Key)}
+		config.Configuration.TLS = append(config.Configuration.TLS, &traefiktls.Configuration{Certificate: cert, EntryPoints: []string{p.EntryPoint}})
 	}
 	p.configurationChan <- config
 }

 func (p *Provider) renewCertificates() {
 	log.Info("Testing certificate renew...")
-	for _, certificate := range p.certificates {
-		crt, err := getX509Certificate(certificate)
+	for _, cert := range p.certificates {
+		crt, err := getX509Certificate(cert)
 		// If there's an error, we assume the cert is broken, and needs update
 		// <= 30 days left, renew certificate
 		if err != nil || crt == nil || crt.NotAfter.Before(time.Now().Add(24*30*time.Hour)) {
 			client, err := p.getClient()
 			if err != nil {
-				log.Infof("Error renewing certificate from LE : %+v, %v", certificate.Domain, err)
+				log.Infof("Error renewing certificate from LE : %+v, %v", cert.Domain, err)
 				continue
 			}

-			log.Infof("Renewing certificate from LE : %+v", certificate.Domain)
+			log.Infof("Renewing certificate from LE : %+v", cert.Domain)

-			renewedCert, err := client.RenewCertificate(acme.CertificateResource{
-				Domain:      certificate.Domain.Main,
-				PrivateKey:  certificate.Key,
-				Certificate: certificate.Certificate,
+			renewedCert, err := client.Certificate.Renew(certificate.Resource{
+				Domain:      cert.Domain.Main,
+				PrivateKey:  cert.Key,
+				Certificate: cert.Certificate,
 			}, true, OSCPMustStaple)

 			if err != nil {
-				log.Errorf("Error renewing certificate from LE: %v, %v", certificate.Domain, err)
+				log.Errorf("Error renewing certificate from LE: %v, %v", cert.Domain, err)
 				continue
 			}

 			if len(renewedCert.Certificate) == 0 || len(renewedCert.PrivateKey) == 0 {
-				log.Errorf("domains %v renew certificate with no value: %v", certificate.Domain.ToStrArray(), certificate)
+				log.Errorf("domains %v renew certificate with no value: %v", cert.Domain.ToStrArray(), cert)
 				continue
 			}

-			p.addCertificateForDomain(certificate.Domain, renewedCert.Certificate, renewedCert.PrivateKey)
+			p.addCertificateForDomain(cert.Domain, renewedCert.Certificate, renewedCert.PrivateKey)
 		}
 	}
 }
@@ -687,8 +682,8 @@ func (p *Provider) getUncheckedDomains(domainsToCheck []string, checkConfigurati
 	allDomains := p.certificateStore.GetAllDomains()

 	// Get ACME certificates
-	for _, certificate := range p.certificates {
-		allDomains = append(allDomains, strings.Join(certificate.Domain.ToStrArray(), ","))
+	for _, cert := range p.certificates {
+		allDomains = append(allDomains, strings.Join(cert.Domain.ToStrArray(), ","))
 	}

 	// Get currently resolved domains
@@ -722,10 +717,10 @@ func searchUncheckedDomains(domainsToCheck []string, existentDomains []string) [
 	return uncheckedDomains
 }

-func getX509Certificate(certificate *Certificate) (*x509.Certificate, error) {
-	tlsCert, err := tls.X509KeyPair(certificate.Certificate, certificate.Key)
+func getX509Certificate(cert *Certificate) (*x509.Certificate, error) {
+	tlsCert, err := tls.X509KeyPair(cert.Certificate, cert.Key)
 	if err != nil {
-		log.Errorf("Failed to load TLS keypair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", certificate.Domain.Main, strings.Join(certificate.Domain.SANs, ","), err)
+		log.Errorf("Failed to load TLS keypair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", cert.Domain.Main, strings.Join(cert.Domain.SANs, ","), err)
 		return nil, err
 	}

@@ -733,7 +728,7 @@ func getX509Certificate(certificate *Certificate) (*x509.Certificate, error) {
 	if crt == nil {
 		crt, err = x509.ParseCertificate(tlsCert.Certificate[0])
 		if err != nil {
-			log.Errorf("Failed to parse TLS keypair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", certificate.Domain.Main, strings.Join(certificate.Domain.SANs, ","), err)
+			log.Errorf("Failed to parse TLS keypair from ACME certificate for domain %q (SAN : %q), certificate will be renewed : %v", cert.Domain.Main, strings.Join(cert.Domain.SANs, ","), err)
 		}
 	}

@@ -770,7 +765,7 @@ func (p *Provider) getValidDomains(domain types.Domain, wildcardAllowed bool) ([
 	var cleanDomains []string
 	for _, domain := range domains {
 		canonicalDomain := types.CanonicalDomain(domain)
-		cleanDomain := acme.UnFqdn(canonicalDomain)
+		cleanDomain := dns01.UnFqdn(canonicalDomain)
 		if canonicalDomain != cleanDomain {
 			log.Warnf("FQDN detected, please remove the trailing dot: %s", canonicalDomain)
 		}
@@ -790,37 +785,3 @@ func isDomainAlreadyChecked(domainToCheck string, existentDomains []string) bool
 	}
 	return false
 }
-
-// SetPropagationCheck to disable the Lego PreCheck.
-func SetPropagationCheck(disable bool) {
-	if disable {
-		acme.PreCheckDNS = func(_, _ string) (bool, error) {
-			return true, nil
-		}
-	}
-}
-
-// SetRecursiveNameServers to provide a custom DNS resolver.
-func SetRecursiveNameServers(dnsResolvers []string) {
-	resolvers := normaliseDNSResolvers(dnsResolvers)
-	if len(resolvers) > 0 {
-		acme.RecursiveNameservers = resolvers
-		log.Infof("Validating FQDN authority with DNS using %+v", resolvers)
-	}
-}
-
-// ensure all servers have a port number
-func normaliseDNSResolvers(dnsResolvers []string) []string {
-	var normalisedResolvers []string
-	for _, server := range dnsResolvers {
-		srv := strings.TrimSpace(server)
-		if len(srv) > 0 {
-			if host, port, err := net.SplitHostPort(srv); err != nil {
-				normalisedResolvers = append(normalisedResolvers, net.JoinHostPort(srv, "53"))
-			} else {
-				normalisedResolvers = append(normalisedResolvers, net.JoinHostPort(host, port))
-			}
-		}
-	}
-	return normalisedResolvers
-}
--- a/provider/acme/provider_test.go
+++ b/provider/acme/provider_test.go
@@ -8,7 +8,7 @@ import (
 	traefiktls "github.com/containous/traefik/tls"
 	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/certcrypto"
 )

 func TestGetUncheckedCertificates(t *testing.T) {
@@ -616,11 +616,11 @@ func TestInitAccount(t *testing.T) {
 			desc: "Existing account with all information",
 			account: &Account{
 				Email:   "foo@foo.net",
-				KeyType: acme.EC256,
+				KeyType: certcrypto.EC256,
 			},
 			expectedAccount: &Account{
 				Email:   "foo@foo.net",
-				KeyType: acme.EC256,
+				KeyType: certcrypto.EC256,
 			},
 		},
 		{
@@ -629,19 +629,19 @@ func TestInitAccount(t *testing.T) {
 			keyType: "EC256",
 			expectedAccount: &Account{
 				Email:   "foo@foo.net",
-				KeyType: acme.EC256,
+				KeyType: certcrypto.EC256,
 			},
 		},
 		{
 			desc: "Existing account with no email",
 			account: &Account{
-				KeyType: acme.RSA4096,
+				KeyType: certcrypto.RSA4096,
 			},
 			email:   "foo@foo.net",
 			keyType: "EC256",
 			expectedAccount: &Account{
 				Email:   "foo@foo.net",
-				KeyType: acme.EC256,
+				KeyType: certcrypto.EC256,
 			},
 		},
 		{
@@ -653,7 +653,7 @@ func TestInitAccount(t *testing.T) {
 			keyType: "EC256",
 			expectedAccount: &Account{
 				Email:   "foo@foo.net",
-				KeyType: acme.EC256,
+				KeyType: certcrypto.EC256,
 			},
 		},
 		{
@@ -664,7 +664,7 @@ func TestInitAccount(t *testing.T) {
 			email: "bar@foo.net",
 			expectedAccount: &Account{
 				Email:   "foo@foo.net",
-				KeyType: acme.RSA4096,
+				KeyType: certcrypto.RSA4096,
 			},
 		},
 	}
--- a/provider/consulcatalog/config_test.go
+++ b/provider/consulcatalog/config_test.go
@@ -428,8 +428,16 @@ func TestProviderBuildConfiguration(t *testing.T) {
 							label.TraefikFrontendPassTLSClientCertInfosNotBefore + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosNotAfter + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosSans + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerCountry + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerLocality + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerProvince + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosSubjectCountry + "=true",
+							label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosSubjectLocality + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization + "=true",
 							label.TraefikFrontendPassTLSClientCertInfosSubjectProvince + "=true",
@@ -558,13 +566,23 @@ func TestProviderBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
@@ -822,6 +840,113 @@ func TestProviderBuildConfiguration(t *testing.T) {
 	}
 }

+func TestProviderBuildConfigurationCustomPrefix(t *testing.T) {
+	prefix := "traefik-test"
+	p := &Provider{
+		Domain:               "localhost",
+		Prefix:               prefix,
+		ExposedByDefault:     false,
+		FrontEndRule:         "Host:{{.ServiceName}}.{{.Domain}}",
+		frontEndRuleTemplate: template.New("consul catalog frontend rule"),
+	}
+
+	testCases := []struct {
+		desc              string
+		nodes             []catalogUpdate
+		expectedFrontends map[string]*types.Frontend
+		expectedBackends  map[string]*types.Backend
+	}{
+		{
+			desc: "Should build config which contains three frontends and one backend",
+			nodes: []catalogUpdate{
+				{
+					Service: &serviceUpdate{
+						ServiceName: "test",
+						Attributes: []string{
+							"random.foo=bar",
+							prefix + ".frontend.rule=Host:A",
+							prefix + ".frontends.test1.rule=Host:B",
+							prefix + ".frontends.test2.rule=Host:C",
+						},
+					},
+					Nodes: []*api.ServiceEntry{
+						{
+							Service: &api.AgentService{
+								Service: "test",
+								Address: "127.0.0.1",
+								Port:    80,
+								Tags: []string{
+									"random.foo=bar",
+								},
+							},
+							Node: &api.Node{
+								Node:    "localhost",
+								Address: "127.0.0.1",
+							},
+						},
+					},
+				},
+			},
+			expectedFrontends: map[string]*types.Frontend{
+				"frontend-test": {
+					Backend:        "backend-test",
+					PassHostHeader: true,
+					Routes: map[string]types.Route{
+						"route-host-test": {
+							Rule: "Host:A",
+						},
+					},
+					EntryPoints: []string{},
+				},
+				"frontend-test-test1": {
+					Backend:        "backend-test",
+					PassHostHeader: true,
+					Routes: map[string]types.Route{
+						"route-host-test-test1": {
+							Rule: "Host:B",
+						},
+					},
+					EntryPoints: []string{},
+				},
+				"frontend-test-test2": {
+					Backend:        "backend-test",
+					PassHostHeader: true,
+					Routes: map[string]types.Route{
+						"route-host-test-test2": {
+							Rule: "Host:C",
+						},
+					},
+					EntryPoints: []string{},
+				},
+			},
+			expectedBackends: map[string]*types.Backend{
+				"backend-test": {
+					Servers: map[string]types.Server{
+						"test-0-O0Tnh-SwzY69M6SurTKP3wNKkzI": {
+							URL:    "http://127.0.0.1:80",
+							Weight: 1,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, test := range testCases {
+		test := test
+		t.Run(test.desc, func(t *testing.T) {
+			t.Parallel()
+
+			nodes := fakeLoadTraefikLabelsSlice(test.nodes, p.Prefix)
+
+			actualConfig := p.buildConfigurationV2(nodes)
+			assert.NotNil(t, actualConfig)
+			assert.Equal(t, test.expectedBackends, actualConfig.Backends)
+			assert.Equal(t, test.expectedFrontends, actualConfig.Frontends)
+		})
+	}
+}
+
 func TestGetTag(t *testing.T) {
 	testCases := []struct {
 		desc         string
--- a/provider/consulcatalog/consul_catalog.go
+++ b/provider/consulcatalog/consul_catalog.go
@@ -578,7 +578,7 @@ func (p *Provider) generateFrontends(service *serviceUpdate) []*serviceUpdate {
 	})

 	// loop over children of <prefix>.frontends.*
-	for _, frontend := range getSegments(p.Prefix+".frontends", p.Prefix, service.TraefikLabels) {
+	for _, frontend := range getSegments(label.Prefix+"frontends", label.Prefix, service.TraefikLabels) {
 		frontends = append(frontends, &serviceUpdate{
 			ServiceName:       service.ServiceName + "-" + frontend.Name,
 			ParentServiceName: service.ServiceName,
@@ -589,6 +589,7 @@ func (p *Provider) generateFrontends(service *serviceUpdate) []*serviceUpdate {

 	return frontends
 }
+
 func getSegments(path string, prefix string, tree map[string]string) []*frontendSegment {
 	segments := make([]*frontendSegment, 0)
 	// find segment names
@@ -604,7 +605,7 @@ func getSegments(path string, prefix string, tree map[string]string) []*frontend
 		labels := make(map[string]string)
 		for key, value := range tree {
 			if strings.HasPrefix(key, path+"."+segment) {
-				labels[prefix+".frontend"+strings.TrimPrefix(key, path+"."+segment)] = value
+				labels[prefix+"frontend"+strings.TrimPrefix(key, path+"."+segment)] = value
 			}
 		}
 		segments = append(segments, &frontendSegment{
--- a/provider/docker/config_container_docker_test.go
+++ b/provider/docker/config_container_docker_test.go
@@ -69,16 +69,24 @@ func TestDockerBuildConfiguration(t *testing.T) {
 				containerJSON(
 					name("test"),
 					labels(map[string]string{
-						label.TraefikFrontendPassTLSClientCertPem:                      "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.TraefikFrontendPassTLSClientCertInfosSans:                "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.TraefikFrontendPassTLSClientCertPem:                         "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.TraefikFrontendPassTLSClientCertInfosSans:                   "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
 					}),
 					ports(nat.PortMap{
 						"80/tcp": {},
@@ -97,13 +105,23 @@ func TestDockerBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
@@ -453,16 +471,24 @@ func TestDockerBuildConfiguration(t *testing.T) {
 						label.TraefikBackendBufferingMemRequestBodyBytes:     "2097152",
 						label.TraefikBackendBufferingRetryExpression:         "IsNetworkError() && Attempts() <= 2",

-						label.TraefikFrontendPassTLSClientCertPem:                      "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.TraefikFrontendPassTLSClientCertInfosSans:                "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.TraefikFrontendPassTLSClientCertPem:                         "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.TraefikFrontendPassTLSClientCertInfosSans:                   "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",

 						label.TraefikFrontendAuthBasic:                        "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
 						label.TraefikFrontendAuthBasicRemoveHeader:            "true",
@@ -557,13 +583,23 @@ func TestDockerBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/docker/config_container_swarm_test.go
+++ b/provider/docker/config_container_swarm_test.go
@@ -99,17 +99,25 @@ func TestSwarmBuildConfiguration(t *testing.T) {
 				swarmService(
 					serviceName("test"),
 					serviceLabels(map[string]string{
-						label.TraefikPort:                                              "80",
-						label.TraefikFrontendPassTLSClientCertPem:                      "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.TraefikFrontendPassTLSClientCertInfosSans:                "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.TraefikPort:                                                 "80",
+						label.TraefikFrontendPassTLSClientCertPem:                         "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.TraefikFrontendPassTLSClientCertInfosSans:                   "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",
 					}),
 					withEndpointSpec(modeVIP),
 					withEndpoint(virtualIP("1", "127.0.0.1/24")),
@@ -126,13 +134,23 @@ func TestSwarmBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/docker/config_segment_test.go
+++ b/provider/docker/config_segment_test.go
@@ -71,18 +71,19 @@ func TestSegmentBuildConfiguration(t *testing.T) {
 				containerJSON(
 					name("foo"),
 					labels(map[string]string{
-						"traefik.sauternes.port":                                                                    "2503",
-						"traefik.sauternes.frontend.entryPoints":                                                    "http,https",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						"traefik.sauternes.port":                                                                       "2503",
+						"traefik.sauternes.frontend.entryPoints":                                                       "http,https",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                   "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",
 					}),
 					ports(nat.PortMap{
 						"80/tcp": {},
@@ -106,13 +107,14 @@ func TestSegmentBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
@@ -353,16 +355,24 @@ func TestSegmentBuildConfiguration(t *testing.T) {
 						label.Prefix + "sauternes." + label.SuffixProtocol: "https",
 						label.Prefix + "sauternes." + label.SuffixWeight:   "12",

-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                   "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",

 						label.Prefix + "sauternes." + label.SuffixFrontendAuthBasicRemoveHeader:            "true",
 						label.Prefix + "sauternes." + label.SuffixFrontendAuthBasicUsers:                   "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
@@ -451,13 +461,23 @@ func TestSegmentBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/docker/docker.go
+++ b/provider/docker/docker.go
@@ -30,22 +30,21 @@ import (
 const (
 	// SwarmAPIVersion is a constant holding the version of the Provider API traefik will use
 	SwarmAPIVersion = "1.24"
-	// SwarmDefaultWatchTime is the duration of the interval when polling docker
-	SwarmDefaultWatchTime = 15 * time.Second
 )

 var _ provider.Provider = (*Provider)(nil)

 // Provider holds configurations of the provider.
 type Provider struct {
-	provider.BaseProvider `mapstructure:",squash" export:"true"`
-	Endpoint              string           `description:"Docker server endpoint. Can be a tcp or a unix socket endpoint"`
-	Domain                string           `description:"Default domain used"`
-	TLS                   *types.ClientTLS `description:"Enable Docker TLS support" export:"true"`
-	ExposedByDefault      bool             `description:"Expose containers by default" export:"true"`
-	UseBindPortIP         bool             `description:"Use the ip address from the bound port, rather than from the inner network" export:"true"`
-	SwarmMode             bool             `description:"Use Docker on Swarm Mode" export:"true"`
-	Network               string           `description:"Default Docker network used" export:"true"`
+	provider.BaseProvider   `mapstructure:",squash" export:"true"`
+	Endpoint                string           `description:"Docker server endpoint. Can be a tcp or a unix socket endpoint"`
+	Domain                  string           `description:"Default domain used"`
+	TLS                     *types.ClientTLS `description:"Enable Docker TLS support" export:"true"`
+	ExposedByDefault        bool             `description:"Expose containers by default" export:"true"`
+	UseBindPortIP           bool             `description:"Use the ip address from the bound port, rather than from the inner network" export:"true"`
+	SwarmMode               bool             `description:"Use Docker on Swarm Mode" export:"true"`
+	Network                 string           `description:"Default Docker network used" export:"true"`
+	SwarmModeRefreshSeconds int              `description:"Polling interval for swarm mode (in seconds)" export:"true"`
 }

 // Init the provider
@@ -97,7 +96,10 @@ func (p *Provider) createClient() (client.APIClient, error) {
 		if err != nil {
 			return nil, err
 		}
-		sockets.ConfigureTransport(tr, hostURL.Scheme, hostURL.Host)
+
+		if err := sockets.ConfigureTransport(tr, hostURL.Scheme, hostURL.Host); err != nil {
+			return nil, err
+		}

 		httpClient = &http.Client{
 			Transport: tr,
@@ -162,7 +164,7 @@ func (p *Provider) Provide(configurationChan chan<- types.ConfigMessage, pool *s
 				if p.SwarmMode {
 					errChan := make(chan error)
 					// TODO: This need to be change. Linked to Swarm events docker/docker#23827
-					ticker := time.NewTicker(SwarmDefaultWatchTime)
+					ticker := time.NewTicker(time.Second * time.Duration(p.SwarmModeRefreshSeconds))
 					pool.GoCtx(func(ctx context.Context) {
 						defer close(errChan)
 						for {
@@ -210,10 +212,15 @@ func (p *Provider) Provide(configurationChan chan<- types.ConfigMessage, pool *s
 						}
 						configuration := p.buildConfiguration(containers)
 						if configuration != nil {
-							configurationChan <- types.ConfigMessage{
+							message := types.ConfigMessage{
 								ProviderName:  "docker",
 								Configuration: configuration,
 							}
+							select {
+							case configurationChan <- message:
+							case <-ctx.Done():
+							}
+
 						}
 					}

--- a/provider/ecs/config_segment_test.go
+++ b/provider/ecs/config_segment_test.go
@@ -328,16 +328,24 @@ func TestSegmentBuildConfiguration(t *testing.T) {
 						label.Prefix + "sauternes." + label.SuffixFrontendAuthForwardTLSInsecureSkipVerify: "true",
 						label.Prefix + "sauternes." + label.SuffixFrontendAuthHeaderField:                  "X-WebAuth-User",

-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                   "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",

 						label.Prefix + "sauternes." + label.SuffixFrontendAuthBasic:                 "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
 						label.Prefix + "sauternes." + label.SuffixFrontendEntryPoints:               "http,https",
@@ -415,13 +423,23 @@ func TestSegmentBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/ecs/config_test.go
+++ b/provider/ecs/config_test.go
@@ -361,16 +361,24 @@ func TestBuildConfiguration(t *testing.T) {
 						label.TraefikBackendBufferingMemRequestBodyBytes:     aws.String("2097152"),
 						label.TraefikBackendBufferingRetryExpression:         aws.String("IsNetworkError() && Attempts() <= 2"),

-						label.TraefikFrontendPassTLSClientCertPem:                      aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosNotBefore:           aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosNotAfter:            aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSans:                aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:   aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:      aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:     aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization: aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:     aws.String("true"),
-						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber: aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertPem:                         aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosNotBefore:              aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosNotAfter:               aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSans:                   aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName:       aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCountry:          aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent:  aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerLocality:         aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization:     aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerProvince:         aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber:     aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:      aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:         aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent: aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:        aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization:    aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:        aws.String("true"),
+						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber:    aws.String("true"),

 						label.TraefikFrontendAuthBasic:                        aws.String("test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0"),
 						label.TraefikFrontendAuthBasicRemoveHeader:            aws.String("true"),
@@ -514,13 +522,23 @@ func TestBuildConfiguration(t *testing.T) {
 								NotBefore: true,
 								Sans:      true,
 								NotAfter:  true,
-								Subject: &types.TLSCLientCertificateSubjectInfos{
-									CommonName:   true,
-									Country:      true,
-									Locality:     true,
-									Organization: true,
-									Province:     true,
-									SerialNumber: true,
+								Subject: &types.TLSCLientCertificateDNInfos{
+									CommonName:      true,
+									Country:         true,
+									DomainComponent: true,
+									Locality:        true,
+									Organization:    true,
+									Province:        true,
+									SerialNumber:    true,
+								},
+								Issuer: &types.TLSCLientCertificateDNInfos{
+									CommonName:      true,
+									Country:         true,
+									DomainComponent: true,
+									Locality:        true,
+									Organization:    true,
+									Province:        true,
+									SerialNumber:    true,
 								},
 							},
 						},
--- a/provider/ecs/ecs.go
+++ b/provider/ecs/ecs.go
@@ -19,9 +19,11 @@ import (
 	"github.com/containous/traefik/provider"
 	"github.com/containous/traefik/safe"
 	"github.com/containous/traefik/types"
+	"github.com/patrickmn/go-cache"
 )

 var _ provider.Provider = (*Provider)(nil)
+var existingTaskDefCache = cache.New(30*time.Minute, 5*time.Minute)

 // Provider holds configurations of the provider.
 type Provider struct {
@@ -240,7 +242,9 @@ func (p *Provider) listInstances(ctx context.Context, client *awsClient) ([]ecsI
 					log.Errorf("Unable to describe tasks for %v", page.TaskArns)
 				} else {
 					for _, t := range resp.Tasks {
-						tasks[aws.StringValue(t.TaskArn)] = t
+						if aws.StringValue(t.LastStatus) == ecs.DesiredStatusRunning {
+							tasks[aws.StringValue(t.TaskArn)] = t
+						}
 					}
 				}
 			}
@@ -289,7 +293,7 @@ func (p *Provider) listInstances(ctx context.Context, client *awsClient) ([]ecsI
 				}

 				var mach *machine
-				if aws.StringValue(task.LaunchType) == ecs.LaunchTypeFargate {
+				if len(task.Attachments) != 0 {
 					var ports []portMapping
 					for _, mapping := range containerDefinition.PortMappings {
 						if mapping != nil {
@@ -398,16 +402,22 @@ func (p *Provider) lookupEc2Instances(ctx context.Context, client *awsClient, cl
 func (p *Provider) lookupTaskDefinitions(ctx context.Context, client *awsClient, taskDefArns map[string]*ecs.Task) (map[string]*ecs.TaskDefinition, error) {
 	taskDef := make(map[string]*ecs.TaskDefinition)
 	for arn, task := range taskDefArns {
-		resp, err := client.ecs.DescribeTaskDefinitionWithContext(ctx, &ecs.DescribeTaskDefinitionInput{
-			TaskDefinition: task.TaskDefinitionArn,
-		})
+		if definition, ok := existingTaskDefCache.Get(arn); ok {
+			taskDef[arn] = definition.(*ecs.TaskDefinition)
+			log.Debugf("Found cached task definition for %s. Skipping the call", arn)
+		} else {
+			resp, err := client.ecs.DescribeTaskDefinitionWithContext(ctx, &ecs.DescribeTaskDefinitionInput{
+				TaskDefinition: task.TaskDefinitionArn,
+			})

-		if err != nil {
-			log.Errorf("Unable to describe task definition: %s", err)
-			return nil, err
+			if err != nil {
+				log.Errorf("Unable to describe task definition: %s", err)
+				return nil, err
+			}
+
+			taskDef[arn] = resp.TaskDefinition
+			existingTaskDefCache.Set(arn, resp.TaskDefinition, cache.DefaultExpiration)
 		}
-
-		taskDef[arn] = resp.TaskDefinition
 	}
 	return taskDef, nil
 }
--- a/provider/file/file.go
+++ b/provider/file/file.go
@@ -175,17 +175,36 @@ func (p *Provider) loadFileConfig(filename string, parseTemplate bool) (*types.C
 	} else {
 		configuration, err = p.DecodeConfiguration(fileContent)
 	}
-
 	if err != nil {
 		return nil, err
 	}
+
+	var tlsConfigs []*tls.Configuration
+	for _, conf := range configuration.TLS {
+		bytes, err := conf.Certificate.CertFile.Read()
+		if err != nil {
+			log.Error(err)
+			continue
+		}
+		conf.Certificate.CertFile = tls.FileOrContent(string(bytes))
+
+		bytes, err = conf.Certificate.KeyFile.Read()
+		if err != nil {
+			log.Error(err)
+			continue
+		}
+		conf.Certificate.KeyFile = tls.FileOrContent(string(bytes))
+		tlsConfigs = append(tlsConfigs, conf)
+	}
+	configuration.TLS = tlsConfigs
+
 	if configuration == nil || configuration.Backends == nil && configuration.Frontends == nil && configuration.TLS == nil {
 		configuration = &types.Configuration{
 			Frontends: make(map[string]*types.Frontend),
 			Backends:  make(map[string]*types.Backend),
 		}
 	}
-	return configuration, err
+	return configuration, nil
 }

 func (p *Provider) loadFileConfigFromDirectory(directory string, configuration *types.Configuration) (*types.Configuration, error) {
--- a/provider/file/file_test.go
+++ b/provider/file/file_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/containous/traefik/safe"
 	"github.com/containous/traefik/types"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

 // createRandomFile Helper
@@ -332,3 +333,24 @@ func createProvider(t *testing.T, test ProvideTestCase, watch bool) (*Provider,
 		os.Remove(tempDir)
 	}
 }
+
+func TestTLSContent(t *testing.T) {
+	tempDir := createTempDir(t, "testdir")
+	defer os.Remove(tempDir)
+
+	fileTLS := createRandomFile(t, tempDir, "CONTENT")
+	fileConfig := createRandomFile(t, tempDir, `
+[[tls]]
+entryPoints = ["https"]
+  [tls.certificate]
+    certFile = "`+fileTLS.Name()+`"
+    keyFile = "`+fileTLS.Name()+`"
+`)
+
+	provider := &Provider{}
+	configuration, err := provider.loadFileConfig(fileConfig.Name(), true)
+	require.NoError(t, err)
+
+	require.Equal(t, "CONTENT", configuration.TLS[0].Certificate.CertFile.String())
+	require.Equal(t, "CONTENT", configuration.TLS[0].Certificate.KeyFile.String())
+}
--- a/provider/kubernetes/builder_configuration_test.go
+++ b/provider/kubernetes/builder_configuration_test.go
@@ -403,13 +403,23 @@ func passTLSClientCert() func(*types.Frontend) {
 			Infos: &types.TLSClientCertificateInfos{
 				NotAfter:  true,
 				NotBefore: true,
-				Subject: &types.TLSCLientCertificateSubjectInfos{
-					Country:      true,
-					Province:     true,
-					Locality:     true,
-					Organization: true,
-					CommonName:   true,
-					SerialNumber: true,
+				Subject: &types.TLSCLientCertificateDNInfos{
+					CommonName:      true,
+					Country:         true,
+					DomainComponent: true,
+					Locality:        true,
+					Organization:    true,
+					Province:        true,
+					SerialNumber:    true,
+				},
+				Issuer: &types.TLSCLientCertificateDNInfos{
+					CommonName:      true,
+					Country:         true,
+					DomainComponent: true,
+					Locality:        true,
+					Organization:    true,
+					Province:        true,
+					SerialNumber:    true,
 				},
 				Sans: true,
 			},
--- a/provider/kubernetes/client.go
+++ b/provider/kubernetes/client.go
@@ -53,6 +53,7 @@ type clientImpl struct {
 	factories            map[string]informers.SharedInformerFactory
 	ingressLabelSelector labels.Selector
 	isNamespaceAll       bool
+	watchedNamespaces    Namespaces
 }

 func newClientImpl(clientset *kubernetes.Clientset) *clientImpl {
@@ -120,6 +121,8 @@ func (c *clientImpl) WatchAll(namespaces Namespaces, stopCh <-chan struct{}) (<-
 		c.isNamespaceAll = true
 	}

+	c.watchedNamespaces = namespaces
+
 	eventHandler := c.newResourceEventHandler(eventCh)
 	for _, ns := range namespaces {
 		factory := informers.NewFilteredSharedInformerFactory(c.clientset, resyncPeriod, ns, nil)
@@ -170,6 +173,10 @@ func (c *clientImpl) GetIngresses() []*extensionsv1beta1.Ingress {

 // UpdateIngressStatus updates an Ingress with a provided status.
 func (c *clientImpl) UpdateIngressStatus(namespace, name, ip, hostname string) error {
+	if !c.isWatchedNamespace(namespace) {
+		return fmt.Errorf("failed to get ingress %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
 	ing, err := c.factories[c.lookupNamespace(namespace)].Extensions().V1beta1().Ingresses().Lister().Ingresses(namespace).Get(name)
 	if err != nil {
 		return fmt.Errorf("failed to get ingress %s/%s: %v", namespace, name, err)
@@ -195,6 +202,10 @@ func (c *clientImpl) UpdateIngressStatus(namespace, name, ip, hostname string) e

 // GetService returns the named service from the given namespace.
 func (c *clientImpl) GetService(namespace, name string) (*corev1.Service, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get service %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
 	service, err := c.factories[c.lookupNamespace(namespace)].Core().V1().Services().Lister().Services(namespace).Get(name)
 	exist, err := translateNotFoundError(err)
 	return service, exist, err
@@ -202,6 +213,10 @@ func (c *clientImpl) GetService(namespace, name string) (*corev1.Service, bool,

 // GetEndpoints returns the named endpoints from the given namespace.
 func (c *clientImpl) GetEndpoints(namespace, name string) (*corev1.Endpoints, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get endpoints %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
 	endpoint, err := c.factories[c.lookupNamespace(namespace)].Core().V1().Endpoints().Lister().Endpoints(namespace).Get(name)
 	exist, err := translateNotFoundError(err)
 	return endpoint, exist, err
@@ -209,6 +224,10 @@ func (c *clientImpl) GetEndpoints(namespace, name string) (*corev1.Endpoints, bo

 // GetSecret returns the named secret from the given namespace.
 func (c *clientImpl) GetSecret(namespace, name string) (*corev1.Secret, bool, error) {
+	if !c.isWatchedNamespace(namespace) {
+		return nil, false, fmt.Errorf("failed to get secret %s/%s: namespace is not within watched namespaces", namespace, name)
+	}
+
 	secret, err := c.factories[c.lookupNamespace(namespace)].Core().V1().Secrets().Lister().Secrets(namespace).Get(name)
 	exist, err := translateNotFoundError(err)
 	return secret, exist, err
@@ -259,3 +278,17 @@ func translateNotFoundError(err error) (bool, error) {
 	}
 	return err == nil, err
 }
+
+// isWatchedNamespace checks to ensure that the namespace is being watched before we request
+// it to ensure we don't panic by requesting an out-of-watch object
+func (c *clientImpl) isWatchedNamespace(ns string) bool {
+	if c.isNamespaceAll {
+		return true
+	}
+	for _, watchedNamespace := range c.watchedNamespaces {
+		if watchedNamespace == ns {
+			return true
+		}
+	}
+	return false
+}
--- a/provider/kubernetes/kubernetes.go
+++ b/provider/kubernetes/kubernetes.go
@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"reflect"
+	"sort"
 	"strconv"
 	"strings"
 	"text/template"
@@ -179,6 +180,8 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 		Frontends: map[string]*types.Frontend{},
 	}

+	tlsConfigs := map[string]*tls.Configuration{}
+
 	for _, i := range ingresses {
 		ingressClass, err := getStringSafeValue(i.Annotations, annotationKubernetesIngressClass, "")
 		if err != nil {
@@ -190,12 +193,10 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 			continue
 		}

-		tlsSection, err := getTLS(i, k8sClient)
-		if err != nil {
+		if err = getTLS(i, k8sClient, tlsConfigs); err != nil {
 			log.Errorf("Error configuring TLS for ingress %s/%s: %v", i.Namespace, i.Name, err)
 			continue
 		}
-		templateObjects.TLS = append(templateObjects.TLS, tlsSection...)

 		if i.Spec.Backend != nil {
 			err := p.addGlobalBackend(k8sClient, i, templateObjects)
@@ -357,15 +358,16 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 							continue
 						}

-						if service.Spec.Type == "ExternalName" {
+						// We have to treat external-name service differently here b/c it doesn't have any endpoints
+						if service.Spec.Type == corev1.ServiceTypeExternalName {
 							url := protocol + "://" + service.Spec.ExternalName
 							if port.Port != 443 && port.Port != 80 {
 								url = fmt.Sprintf("%s:%d", url, port.Port)
 							}
-
+							externalNameServiceWeight := weightAllocator.getWeight(r.Host, pa.Path, pa.Backend.ServiceName)
 							templateObjects.Backends[baseName].Servers[url] = types.Server{
 								URL:    url,
-								Weight: label.DefaultWeight,
+								Weight: externalNameServiceWeight,
 							}
 						} else {
 							endpoints, exists, err := k8sClient.GetEndpoints(service.Namespace, service.Name)
@@ -415,6 +417,9 @@ func (p *Provider) loadIngresses(k8sClient Client) (*types.Configuration, error)
 			log.Errorf("Cannot update Ingress %s/%s due to error: %v", i.Namespace, i.Name, err)
 		}
 	}
+
+	templateObjects.TLS = getTLSConfig(tlsConfigs)
+
 	return templateObjects, nil
 }

@@ -635,37 +640,74 @@ func getRuleForHost(host string) string {
 	return "Host:" + host
 }

-func getTLS(ingress *extensionsv1beta1.Ingress, k8sClient Client) ([]*tls.Configuration, error) {
-	var tlsConfigs []*tls.Configuration
-
+func getTLS(ingress *extensionsv1beta1.Ingress, k8sClient Client, tlsConfigs map[string]*tls.Configuration) error {
 	for _, t := range ingress.Spec.TLS {
-		secret, exists, err := k8sClient.GetSecret(ingress.Namespace, t.SecretName)
-		if err != nil {
-			return nil, fmt.Errorf("failed to fetch secret %s/%s: %v", ingress.Namespace, t.SecretName, err)
-		}
-		if !exists {
-			return nil, fmt.Errorf("secret %s/%s does not exist", ingress.Namespace, t.SecretName)
+		if t.SecretName == "" {
+			log.Debugf("Skipping TLS sub-section for ingress %s/%s: No secret name provided", ingress.Namespace, ingress.Name)
+			continue
 		}

-		cert, key, err := getCertificateBlocks(secret, ingress.Namespace, t.SecretName)
-		if err != nil {
-			return nil, err
+		newEntryPoints := getSliceStringValue(ingress.Annotations, annotationKubernetesFrontendEntryPoints)
+
+		configKey := ingress.Namespace + "/" + t.SecretName
+		if tlsConfig, tlsExists := tlsConfigs[configKey]; tlsExists {
+			for _, entryPoint := range newEntryPoints {
+				tlsConfig.EntryPoints = mergeEntryPoint(tlsConfig.EntryPoints, entryPoint)
+			}
+		} else {
+			secret, exists, err := k8sClient.GetSecret(ingress.Namespace, t.SecretName)
+			if err != nil {
+				return fmt.Errorf("failed to fetch secret %s/%s: %v", ingress.Namespace, t.SecretName, err)
+			}
+			if !exists {
+				return fmt.Errorf("secret %s/%s does not exist", ingress.Namespace, t.SecretName)
+			}
+
+			cert, key, err := getCertificateBlocks(secret, ingress.Namespace, t.SecretName)
+			if err != nil {
+				return err
+			}
+
+			sort.Strings(newEntryPoints)
+
+			tlsConfig = &tls.Configuration{
+				EntryPoints: newEntryPoints,
+				Certificate: &tls.Certificate{
+					CertFile: tls.FileOrContent(cert),
+					KeyFile:  tls.FileOrContent(key),
+				},
+			}
+			tlsConfigs[configKey] = tlsConfig
 		}
-
-		entryPoints := getSliceStringValue(ingress.Annotations, annotationKubernetesFrontendEntryPoints)
-
-		tlsConfig := &tls.Configuration{
-			EntryPoints: entryPoints,
-			Certificate: &tls.Certificate{
-				CertFile: tls.FileOrContent(cert),
-				KeyFile:  tls.FileOrContent(key),
-			},
-		}
-
-		tlsConfigs = append(tlsConfigs, tlsConfig)
 	}

-	return tlsConfigs, nil
+	return nil
+}
+
+func getTLSConfig(tlsConfigs map[string]*tls.Configuration) []*tls.Configuration {
+	var secretNames []string
+	for secretName := range tlsConfigs {
+		secretNames = append(secretNames, secretName)
+	}
+	sort.Strings(secretNames)
+
+	var configs []*tls.Configuration
+	for _, secretName := range secretNames {
+		configs = append(configs, tlsConfigs[secretName])
+	}
+
+	return configs
+}
+
+func mergeEntryPoint(entryPoints []string, newEntryPoint string) []string {
+	for _, ep := range entryPoints {
+		if ep == newEntryPoint {
+			return entryPoints
+		}
+	}
+	entryPoints = append(entryPoints, newEntryPoint)
+	sort.Strings(entryPoints)
+	return entryPoints
 }

 func getCertificateBlocks(secret *corev1.Secret, namespace, secretName string) (string, string, error) {
@@ -902,7 +944,7 @@ func loadAuthTLSSecret(namespace, secretName string, k8sClient Client) (string,
 func getFrontendRedirect(i *extensionsv1beta1.Ingress, baseName, path string) *types.Redirect {
 	permanent := getBoolValue(i.Annotations, annotationKubernetesRedirectPermanent, false)

-	if appRoot := getStringValue(i.Annotations, annotationKubernetesAppRoot, ""); appRoot != "" && path == "/" {
+	if appRoot := getStringValue(i.Annotations, annotationKubernetesAppRoot, ""); appRoot != "" && (path == "/" || path == "") {
 		return &types.Redirect{
 			Regex:       fmt.Sprintf("%s$", baseName),
 			Replacement: fmt.Sprintf("%s/%s", strings.TrimRight(baseName, "/"), strings.TrimLeft(appRoot, "/")),
--- a/provider/kubernetes/kubernetes_test.go
+++ b/provider/kubernetes/kubernetes_test.go
@@ -1148,6 +1148,15 @@ infos:
    organization: true
    commonname: true
    serialnumber: true
+    domaincomponent: true
+  issuer:
+    country: true
+    province: true
+    locality: true
+    organization: true
+    commonname: true
+    serialnumber: true
+    domaincomponent: true
 `),
 			iAnnotation(annotationKubernetesIngressClass, traefikDefaultRealm),
 			iRules(
@@ -1299,6 +1308,18 @@ rateset:
 				),
 			),
 		),
+		buildIngress(
+			iNamespace("testing"),
+			iAnnotation(annotationKubernetesAppRoot, "/root"),
+			iRules(
+				iRule(
+					iHost("root3"),
+					iPaths(
+						onePath(iBackend("service1", intstr.FromInt(80))),
+					),
+				),
+			),
+		),
 		buildIngress(
 			iNamespace("testing"),
 			iAnnotation(annotationKubernetesIngressClass, "traefik"),
@@ -1503,6 +1524,11 @@ rateset:
 				servers(),
 				lbMethod("wrr"),
 			),
+			backend("root3",
+				servers(
+					server("http://example.com", weight(1))),
+				lbMethod("wrr"),
+			),
 			backend("protocol/valid",
 				servers(
 					server("h2c://example.com", weight(1)),
@@ -1658,6 +1684,13 @@ rateset:
 					route("root", "Host:root"),
 				),
 			),
+			frontend("root3",
+				passHostHeader(),
+				redirectRegex("root3$", "root3/root"),
+				routes(
+					route("root3", "Host:root3"),
+				),
+			),
 			frontend("protocol/valid",
 				passHostHeader(),
 				routes(
@@ -2800,11 +2833,21 @@ func TestGetTLS(t *testing.T) {
 		),
 	)

+	testIngressWithoutSecret := buildIngress(
+		iNamespace("testing"),
+		iRules(
+			iRule(iHost("ep1.example.com")),
+		),
+		iTLSes(
+			iTLS("", "foo.com"),
+		),
+	)
+
 	testCases := []struct {
 		desc      string
 		ingress   *extensionsv1beta1.Ingress
 		client    Client
-		result    []*tls.Configuration
+		result    map[string]*tls.Configuration
 		errResult string
 	}{
 		{
@@ -2884,11 +2927,21 @@ func TestGetTLS(t *testing.T) {
 				),
 				iTLSes(
 					iTLS("test-secret"),
-					iTLS("test-secret"),
+					iTLS("test-secret2"),
 				),
 			),
 			client: clientMock{
 				secrets: []*corev1.Secret{
+					{
+						ObjectMeta: metav1.ObjectMeta{
+							Name:      "test-secret2",
+							Namespace: "testing",
+						},
+						Data: map[string][]byte{
+							"tls.crt": []byte("tls-crt"),
+							"tls.key": []byte("tls-key"),
+						},
+					},
 					{
 						ObjectMeta: metav1.ObjectMeta{
 							Name:      "test-secret",
@@ -2901,14 +2954,14 @@ func TestGetTLS(t *testing.T) {
 					},
 				},
 			},
-			result: []*tls.Configuration{
-				{
+			result: map[string]*tls.Configuration{
+				"testing/test-secret": {
 					Certificate: &tls.Certificate{
 						CertFile: tls.FileOrContent("tls-crt"),
 						KeyFile:  tls.FileOrContent("tls-key"),
 					},
 				},
-				{
+				"testing/test-secret2": {
 					Certificate: &tls.Certificate{
 						CertFile: tls.FileOrContent("tls-crt"),
 						KeyFile:  tls.FileOrContent("tls-key"),
@@ -2916,6 +2969,12 @@ func TestGetTLS(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc:    "return nil when no secret is defined",
+			ingress: testIngressWithoutSecret,
+			client:  clientMock{},
+			result:  map[string]*tls.Configuration{},
+		},
 		{
 			desc: "pass the endpoints defined in the annotation to the certificate",
 			ingress: buildIngress(
@@ -2938,9 +2997,9 @@ func TestGetTLS(t *testing.T) {
 					},
 				},
 			},
-			result: []*tls.Configuration{
-				{
-					EntryPoints: []string{"https", "api-secure"},
+			result: map[string]*tls.Configuration{
+				"testing/test-secret": {
+					EntryPoints: []string{"api-secure", "https"},
 					Certificate: &tls.Certificate{
 						CertFile: tls.FileOrContent("tls-crt"),
 						KeyFile:  tls.FileOrContent("tls-key"),
@@ -2955,7 +3014,8 @@ func TestGetTLS(t *testing.T) {
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()

-			tlsConfigs, err := getTLS(test.ingress, test.client)
+			tlsConfigs := map[string]*tls.Configuration{}
+			err := getTLS(test.ingress, test.client, tlsConfigs)

 			if test.errResult != "" {
 				assert.EqualError(t, err, test.errResult)
@@ -3206,6 +3266,7 @@ func TestPercentageWeightServiceAnnotation(t *testing.T) {
 		buildIngress(
 			iAnnotation(annotationKubernetesServiceWeights, `
 service1: 10%
+service3: 20%
 `),
 			iNamespace("testing"),
 			iRules(
@@ -3214,6 +3275,7 @@ service1: 10%
 					iPaths(
 						onePath(iPath("/foo"), iBackend("service1", intstr.FromString("8080"))),
 						onePath(iPath("/foo"), iBackend("service2", intstr.FromString("7070"))),
+						onePath(iPath("/foo"), iBackend("service3", intstr.FromString("9090"))),
 						onePath(iPath("/bar"), iBackend("service2", intstr.FromString("7070"))),
 					)),
 			),
@@ -3238,6 +3300,16 @@ service1: 10%
 				sPorts(sPort(7070, "")),
 			),
 		),
+		buildService(
+			sName("service3"),
+			sNamespace("testing"),
+			sUID("1"),
+			sSpec(
+				sType(corev1.ServiceTypeExternalName),
+				sExternalName("example.com"),
+				sPorts(sPort(9090, "")),
+			),
+		),
 	}

 	endpoints := []*corev1.Endpoints{
@@ -3285,8 +3357,9 @@ service1: 10%
 				servers(
 					server("http://10.10.0.1:8080", weight(int(newPercentageValueFromFloat64(0.05)))),
 					server("http://10.10.0.2:8080", weight(int(newPercentageValueFromFloat64(0.05)))),
-					server("http://10.10.0.3:7070", weight(int(newPercentageValueFromFloat64(0.45)))),
-					server("http://10.10.0.4:7070", weight(int(newPercentageValueFromFloat64(0.45)))),
+					server("http://10.10.0.3:7070", weight(int(newPercentageValueFromFloat64(0.35)))),
+					server("http://10.10.0.4:7070", weight(int(newPercentageValueFromFloat64(0.35)))),
+					server("http://example.com:9090", weight(int(newPercentageValueFromFloat64(0.2)))),
 				),
 				lbMethod("wrr"),
 			),
--- a/provider/kubernetes/weight_allocator.go
+++ b/provider/kubernetes/weight_allocator.go
@@ -7,6 +7,7 @@ import (

 	"github.com/containous/traefik/provider/label"
 	"gopkg.in/yaml.v2"
+	corev1 "k8s.io/api/core/v1"
 	extensionsv1beta1 "k8s.io/api/extensions/v1beta1"
 )

@@ -165,6 +166,23 @@ func getServiceInstanceCounts(ingress *extensionsv1beta1.Ingress, client Client)

 	for _, rule := range ingress.Spec.Rules {
 		for _, pa := range rule.HTTP.Paths {
+			svc, exists, err := client.GetService(ingress.Namespace, pa.Backend.ServiceName)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get service %s/%s: %v", ingress.Namespace, pa.Backend.ServiceName, err)
+			}
+			if !exists {
+				return nil, fmt.Errorf("service not found for %s/%s", ingress.Namespace, pa.Backend.ServiceName)
+			}
+			if svc.Spec.Type == corev1.ServiceTypeExternalName {
+				// external-name service has only one instance b/c it will actually be interpreted as a DNS record
+				// instead of real server.
+				serviceInstanceCounts[ingressService{
+					host:    rule.Host,
+					path:    pa.Path,
+					service: pa.Backend.ServiceName,
+				}] = 1
+				continue
+			}
 			count := 0
 			endpoints, exists, err := client.GetEndpoints(ingress.Namespace, pa.Backend.ServiceName)
 			if err != nil {
--- a/provider/kubernetes/weight_allocator_test.go
+++ b/provider/kubernetes/weight_allocator_test.go
@@ -169,6 +169,24 @@ service1: 1000%

 func TestComputeServiceWeights(t *testing.T) {
 	client := clientMock{
+		services: []*corev1.Service{
+			buildService(
+				sName("service1"),
+				sNamespace("testing"),
+			),
+			buildService(
+				sName("service2"),
+				sNamespace("testing"),
+			),
+			buildService(
+				sName("service3"),
+				sNamespace("testing"),
+			),
+			buildService(
+				sName("service4"),
+				sNamespace("testing"),
+			),
+		},
 		endpoints: []*corev1.Endpoints{
 			buildEndpoint(
 				eNamespace("testing"),
@@ -446,8 +464,12 @@ service2: 80%
 			if test.expectError {
 				require.Error(t, err)
 			} else {
-				for ingSvc, percentage := range test.expectedWeights {
-					assert.Equal(t, int(percentage), weightAllocator.getWeight(ingSvc.host, ingSvc.path, ingSvc.service))
+				if err != nil {
+					t.Errorf("%v failed: %v", test.desc, err)
+				} else {
+					for ingSvc, percentage := range test.expectedWeights {
+						assert.Equal(t, int(percentage), weightAllocator.getWeight(ingSvc.host, ingSvc.path, ingSvc.service))
+					}
 				}
 			}
 		})
--- a/provider/kv/keynames.go
+++ b/provider/kv/keynames.go
@@ -26,27 +26,36 @@ const (
 	pathBackendBufferingMemRequestBodyBytes     = pathBackendBuffering + "memrequestbodybytes"
 	pathBackendBufferingRetryExpression         = pathBackendBuffering + "retryexpression"

-	pathFrontends                                         = "/frontends/"
-	pathFrontendBackend                                   = "/backend"
-	pathFrontendPriority                                  = "/priority"
-	pathFrontendPassHostHeaderDeprecated                  = "/passHostHeader" // Deprecated
-	pathFrontendPassHostHeader                            = "/passhostheader"
-	pathFrontendPassTLSClientCert                         = "/passTLSClientCert"
-	pathFrontendPassTLSClientCertPem                      = pathFrontendPassTLSClientCert + "/pem"
-	pathFrontendPassTLSClientCertInfos                    = pathFrontendPassTLSClientCert + "/infos"
-	pathFrontendPassTLSClientCertInfosNotAfter            = pathFrontendPassTLSClientCertInfos + "/notAfter"
-	pathFrontendPassTLSClientCertInfosNotBefore           = pathFrontendPassTLSClientCertInfos + "/notBefore"
-	pathFrontendPassTLSClientCertInfosSans                = pathFrontendPassTLSClientCertInfos + "/sans"
-	pathFrontendPassTLSClientCertInfosSubject             = pathFrontendPassTLSClientCertInfos + "/subject"
-	pathFrontendPassTLSClientCertInfosSubjectCommonName   = pathFrontendPassTLSClientCertInfosSubject + "/commonName"
-	pathFrontendPassTLSClientCertInfosSubjectCountry      = pathFrontendPassTLSClientCertInfosSubject + "/country"
-	pathFrontendPassTLSClientCertInfosSubjectLocality     = pathFrontendPassTLSClientCertInfosSubject + "/locality"
-	pathFrontendPassTLSClientCertInfosSubjectOrganization = pathFrontendPassTLSClientCertInfosSubject + "/organization"
-	pathFrontendPassTLSClientCertInfosSubjectProvince     = pathFrontendPassTLSClientCertInfosSubject + "/province"
-	pathFrontendPassTLSClientCertInfosSubjectSerialNumber = pathFrontendPassTLSClientCertInfosSubject + "/serialNumber"
-	pathFrontendPassTLSCert                               = "/passtlscert"
-	pathFrontendWhiteListSourceRange                      = "/whitelist/sourcerange"
-	pathFrontendWhiteListUseXForwardedFor                 = "/whitelist/usexforwardedfor"
+	pathFrontends                                            = "/frontends/"
+	pathFrontendBackend                                      = "/backend"
+	pathFrontendPriority                                     = "/priority"
+	pathFrontendPassHostHeaderDeprecated                     = "/passHostHeader" // Deprecated
+	pathFrontendPassHostHeader                               = "/passhostheader"
+	pathFrontendPassTLSClientCert                            = "/passtlsclientcert"
+	pathFrontendPassTLSClientCertPem                         = pathFrontendPassTLSClientCert + "/pem"
+	pathFrontendPassTLSClientCertInfos                       = pathFrontendPassTLSClientCert + "/infos"
+	pathFrontendPassTLSClientCertInfosNotAfter               = pathFrontendPassTLSClientCertInfos + "/notafter"
+	pathFrontendPassTLSClientCertInfosNotBefore              = pathFrontendPassTLSClientCertInfos + "/notbefore"
+	pathFrontendPassTLSClientCertInfosSans                   = pathFrontendPassTLSClientCertInfos + "/sans"
+	pathFrontendPassTLSClientCertInfosIssuer                 = pathFrontendPassTLSClientCertInfos + "/issuer"
+	pathFrontendPassTLSClientCertInfosIssuerCommonName       = pathFrontendPassTLSClientCertInfosIssuer + "/commonname"
+	pathFrontendPassTLSClientCertInfosIssuerCountry          = pathFrontendPassTLSClientCertInfosIssuer + "/country"
+	pathFrontendPassTLSClientCertInfosIssuerDomainComponent  = pathFrontendPassTLSClientCertInfosIssuer + "/domaincomponent"
+	pathFrontendPassTLSClientCertInfosIssuerLocality         = pathFrontendPassTLSClientCertInfosIssuer + "/locality"
+	pathFrontendPassTLSClientCertInfosIssuerOrganization     = pathFrontendPassTLSClientCertInfosIssuer + "/organization"
+	pathFrontendPassTLSClientCertInfosIssuerProvince         = pathFrontendPassTLSClientCertInfosIssuer + "/province"
+	pathFrontendPassTLSClientCertInfosIssuerSerialNumber     = pathFrontendPassTLSClientCertInfosIssuer + "/serialnumber"
+	pathFrontendPassTLSClientCertInfosSubject                = pathFrontendPassTLSClientCertInfos + "/subject"
+	pathFrontendPassTLSClientCertInfosSubjectCommonName      = pathFrontendPassTLSClientCertInfosSubject + "/commonname"
+	pathFrontendPassTLSClientCertInfosSubjectCountry         = pathFrontendPassTLSClientCertInfosSubject + "/country"
+	pathFrontendPassTLSClientCertInfosSubjectDomainComponent = pathFrontendPassTLSClientCertInfosSubject + "/domaincomponent"
+	pathFrontendPassTLSClientCertInfosSubjectLocality        = pathFrontendPassTLSClientCertInfosSubject + "/locality"
+	pathFrontendPassTLSClientCertInfosSubjectOrganization    = pathFrontendPassTLSClientCertInfosSubject + "/organization"
+	pathFrontendPassTLSClientCertInfosSubjectProvince        = pathFrontendPassTLSClientCertInfosSubject + "/province"
+	pathFrontendPassTLSClientCertInfosSubjectSerialNumber    = pathFrontendPassTLSClientCertInfosSubject + "/serialnumber"
+	pathFrontendPassTLSCert                                  = "/passtlscert"
+	pathFrontendWhiteListSourceRange                         = "/whitelist/sourcerange"
+	pathFrontendWhiteListUseXForwardedFor                    = "/whitelist/usexforwardedfor"

 	pathFrontendBasicAuth                        = "/basicauth" // Deprecated
 	pathFrontendAuth                             = "/auth/"
--- a/provider/kv/kv_config.go
+++ b/provider/kv/kv_config.go
@@ -403,16 +403,31 @@ func (p *Provider) getTLSClientCert(rootPath string) *types.TLSClientHeaders {
 		}

 		if p.hasPrefix(rootPath, pathFrontendPassTLSClientCertInfosSubject) {
-			subject := &types.TLSCLientCertificateSubjectInfos{
-				CommonName:   p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectCommonName),
-				Country:      p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectCountry),
-				Locality:     p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectLocality),
-				Organization: p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectOrganization),
-				Province:     p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectProvince),
-				SerialNumber: p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectSerialNumber),
+			subject := &types.TLSCLientCertificateDNInfos{
+				CommonName:      p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectCommonName),
+				Country:         p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectCountry),
+				DomainComponent: p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectDomainComponent),
+				Locality:        p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectLocality),
+				Organization:    p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectOrganization),
+				Province:        p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectProvince),
+				SerialNumber:    p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosSubjectSerialNumber),
 			}
 			infos.Subject = subject
 		}
+
+		if p.hasPrefix(rootPath, pathFrontendPassTLSClientCertInfosIssuer) {
+			issuer := &types.TLSCLientCertificateDNInfos{
+				CommonName:      p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerCommonName),
+				Country:         p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerCountry),
+				DomainComponent: p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerDomainComponent),
+				Locality:        p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerLocality),
+				Organization:    p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerOrganization),
+				Province:        p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerProvince),
+				SerialNumber:    p.getBool(false, rootPath, pathFrontendPassTLSClientCertInfosIssuerSerialNumber),
+			}
+			infos.Issuer = issuer
+		}
+
 		tlsClientHeaders.Infos = infos
 	}
 	return tlsClientHeaders
--- a/provider/kv/kv_config_test.go
+++ b/provider/kv/kv_config_test.go
@@ -284,8 +284,16 @@ func TestProviderBuildConfiguration(t *testing.T) {
 					withPair(pathFrontendPassTLSClientCertInfosNotBefore, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosNotAfter, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosSans, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerCommonName, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerCountry, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerDomainComponent, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerLocality, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerOrganization, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerProvince, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosIssuerSerialNumber, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosSubjectCommonName, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosSubjectCountry, "true"),
+					withPair(pathFrontendPassTLSClientCertInfosSubjectDomainComponent, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosSubjectLocality, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosSubjectOrganization, "true"),
 					withPair(pathFrontendPassTLSClientCertInfosSubjectProvince, "true"),
@@ -421,13 +429,23 @@ func TestProviderBuildConfiguration(t *testing.T) {
 								NotBefore: true,
 								Sans:      true,
 								NotAfter:  true,
-								Subject: &types.TLSCLientCertificateSubjectInfos{
-									CommonName:   true,
-									Country:      true,
-									Locality:     true,
-									Organization: true,
-									Province:     true,
-									SerialNumber: true,
+								Subject: &types.TLSCLientCertificateDNInfos{
+									CommonName:      true,
+									Country:         true,
+									DomainComponent: true,
+									Locality:        true,
+									Organization:    true,
+									Province:        true,
+									SerialNumber:    true,
+								},
+								Issuer: &types.TLSCLientCertificateDNInfos{
+									CommonName:      true,
+									Country:         true,
+									DomainComponent: true,
+									Locality:        true,
+									Organization:    true,
+									Province:        true,
+									SerialNumber:    true,
 								},
 							},
 						},
--- a/provider/label/names.go
+++ b/provider/label/names.go
@@ -2,217 +2,235 @@ package label

 // Traefik labels
 const (
-	Prefix                                                   = "traefik."
-	SuffixBackend                                            = "backend"
-	SuffixDomain                                             = "domain"
-	SuffixEnable                                             = "enable"
-	SuffixPort                                               = "port"
-	SuffixPortName                                           = "portName"
-	SuffixPortIndex                                          = "portIndex"
-	SuffixProtocol                                           = "protocol"
-	SuffixTags                                               = "tags"
-	SuffixWeight                                             = "weight"
-	SuffixBackendID                                          = "backend.id"
-	SuffixBackendCircuitBreaker                              = "backend.circuitbreaker"
-	SuffixBackendCircuitBreakerExpression                    = "backend.circuitbreaker.expression"
-	SuffixBackendHealthCheckScheme                           = "backend.healthcheck.scheme"
-	SuffixBackendHealthCheckPath                             = "backend.healthcheck.path"
-	SuffixBackendHealthCheckPort                             = "backend.healthcheck.port"
-	SuffixBackendHealthCheckInterval                         = "backend.healthcheck.interval"
-	SuffixBackendHealthCheckHostname                         = "backend.healthcheck.hostname"
-	SuffixBackendHealthCheckHeaders                          = "backend.healthcheck.headers"
-	SuffixBackendLoadBalancer                                = "backend.loadbalancer"
-	SuffixBackendLoadBalancerMethod                          = SuffixBackendLoadBalancer + ".method"
-	SuffixBackendLoadBalancerSticky                          = SuffixBackendLoadBalancer + ".sticky"
-	SuffixBackendLoadBalancerStickiness                      = SuffixBackendLoadBalancer + ".stickiness"
-	SuffixBackendLoadBalancerStickinessCookieName            = SuffixBackendLoadBalancer + ".stickiness.cookieName"
-	SuffixBackendMaxConnAmount                               = "backend.maxconn.amount"
-	SuffixBackendMaxConnExtractorFunc                        = "backend.maxconn.extractorfunc"
-	SuffixBackendBuffering                                   = "backend.buffering"
-	SuffixBackendResponseForwardingFlushInterval             = "backend.responseForwarding.flushInterval"
-	SuffixBackendBufferingMaxRequestBodyBytes                = SuffixBackendBuffering + ".maxRequestBodyBytes"
-	SuffixBackendBufferingMemRequestBodyBytes                = SuffixBackendBuffering + ".memRequestBodyBytes"
-	SuffixBackendBufferingMaxResponseBodyBytes               = SuffixBackendBuffering + ".maxResponseBodyBytes"
-	SuffixBackendBufferingMemResponseBodyBytes               = SuffixBackendBuffering + ".memResponseBodyBytes"
-	SuffixBackendBufferingRetryExpression                    = SuffixBackendBuffering + ".retryExpression"
-	SuffixFrontend                                           = "frontend"
-	SuffixFrontendAuth                                       = SuffixFrontend + ".auth"
-	SuffixFrontendAuthBasic                                  = SuffixFrontendAuth + ".basic"
-	SuffixFrontendAuthBasicRemoveHeader                      = SuffixFrontendAuthBasic + ".removeHeader"
-	SuffixFrontendAuthBasicUsers                             = SuffixFrontendAuthBasic + ".users"
-	SuffixFrontendAuthBasicUsersFile                         = SuffixFrontendAuthBasic + ".usersFile"
-	SuffixFrontendAuthDigest                                 = SuffixFrontendAuth + ".digest"
-	SuffixFrontendAuthDigestRemoveHeader                     = SuffixFrontendAuthDigest + ".removeHeader"
-	SuffixFrontendAuthDigestUsers                            = SuffixFrontendAuthDigest + ".users"
-	SuffixFrontendAuthDigestUsersFile                        = SuffixFrontendAuthDigest + ".usersFile"
-	SuffixFrontendAuthForward                                = SuffixFrontendAuth + ".forward"
-	SuffixFrontendAuthForwardAddress                         = SuffixFrontendAuthForward + ".address"
-	SuffixFrontendAuthForwardAuthResponseHeaders             = SuffixFrontendAuthForward + ".authResponseHeaders"
-	SuffixFrontendAuthForwardTLS                             = SuffixFrontendAuthForward + ".tls"
-	SuffixFrontendAuthForwardTLSCa                           = SuffixFrontendAuthForwardTLS + ".ca"
-	SuffixFrontendAuthForwardTLSCaOptional                   = SuffixFrontendAuthForwardTLS + ".caOptional"
-	SuffixFrontendAuthForwardTLSCert                         = SuffixFrontendAuthForwardTLS + ".cert"
-	SuffixFrontendAuthForwardTLSInsecureSkipVerify           = SuffixFrontendAuthForwardTLS + ".insecureSkipVerify"
-	SuffixFrontendAuthForwardTLSKey                          = SuffixFrontendAuthForwardTLS + ".key"
-	SuffixFrontendAuthForwardTrustForwardHeader              = SuffixFrontendAuthForward + ".trustForwardHeader"
-	SuffixFrontendAuthHeaderField                            = SuffixFrontendAuth + ".headerField"
-	SuffixFrontendEntryPoints                                = "frontend.entryPoints"
-	SuffixFrontendHeaders                                    = "frontend.headers."
-	SuffixFrontendRequestHeaders                             = SuffixFrontendHeaders + "customRequestHeaders"
-	SuffixFrontendResponseHeaders                            = SuffixFrontendHeaders + "customResponseHeaders"
-	SuffixFrontendHeadersAllowedHosts                        = SuffixFrontendHeaders + "allowedHosts"
-	SuffixFrontendHeadersHostsProxyHeaders                   = SuffixFrontendHeaders + "hostsProxyHeaders"
-	SuffixFrontendHeadersSSLForceHost                        = SuffixFrontendHeaders + "SSLForceHost"
-	SuffixFrontendHeadersSSLRedirect                         = SuffixFrontendHeaders + "SSLRedirect"
-	SuffixFrontendHeadersSSLTemporaryRedirect                = SuffixFrontendHeaders + "SSLTemporaryRedirect"
-	SuffixFrontendHeadersSSLHost                             = SuffixFrontendHeaders + "SSLHost"
-	SuffixFrontendHeadersSSLProxyHeaders                     = SuffixFrontendHeaders + "SSLProxyHeaders"
-	SuffixFrontendHeadersSTSSeconds                          = SuffixFrontendHeaders + "STSSeconds"
-	SuffixFrontendHeadersSTSIncludeSubdomains                = SuffixFrontendHeaders + "STSIncludeSubdomains"
-	SuffixFrontendHeadersSTSPreload                          = SuffixFrontendHeaders + "STSPreload"
-	SuffixFrontendHeadersForceSTSHeader                      = SuffixFrontendHeaders + "forceSTSHeader"
-	SuffixFrontendHeadersFrameDeny                           = SuffixFrontendHeaders + "frameDeny"
-	SuffixFrontendHeadersCustomFrameOptionsValue             = SuffixFrontendHeaders + "customFrameOptionsValue"
-	SuffixFrontendHeadersContentTypeNosniff                  = SuffixFrontendHeaders + "contentTypeNosniff"
-	SuffixFrontendHeadersBrowserXSSFilter                    = SuffixFrontendHeaders + "browserXSSFilter"
-	SuffixFrontendHeadersCustomBrowserXSSValue               = SuffixFrontendHeaders + "customBrowserXSSValue"
-	SuffixFrontendHeadersContentSecurityPolicy               = SuffixFrontendHeaders + "contentSecurityPolicy"
-	SuffixFrontendHeadersPublicKey                           = SuffixFrontendHeaders + "publicKey"
-	SuffixFrontendHeadersReferrerPolicy                      = SuffixFrontendHeaders + "referrerPolicy"
-	SuffixFrontendHeadersIsDevelopment                       = SuffixFrontendHeaders + "isDevelopment"
-	SuffixFrontendPassHostHeader                             = "frontend.passHostHeader"
-	SuffixFrontendPassTLSClientCert                          = "frontend.passTLSClientCert"
-	SuffixFrontendPassTLSClientCertPem                       = SuffixFrontendPassTLSClientCert + ".pem"
-	SuffixFrontendPassTLSClientCertInfos                     = SuffixFrontendPassTLSClientCert + ".infos"
-	SuffixFrontendPassTLSClientCertInfosNotAfter             = SuffixFrontendPassTLSClientCertInfos + ".notAfter"
-	SuffixFrontendPassTLSClientCertInfosNotBefore            = SuffixFrontendPassTLSClientCertInfos + ".notBefore"
-	SuffixFrontendPassTLSClientCertInfosSans                 = SuffixFrontendPassTLSClientCertInfos + ".sans"
-	SuffixFrontendPassTLSClientCertInfosSubject              = SuffixFrontendPassTLSClientCertInfos + ".subject"
-	SuffixFrontendPassTLSClientCertInfosSubjectCommonName    = SuffixFrontendPassTLSClientCertInfosSubject + ".commonName"
-	SuffixFrontendPassTLSClientCertInfosSubjectCountry       = SuffixFrontendPassTLSClientCertInfosSubject + ".country"
-	SuffixFrontendPassTLSClientCertInfosSubjectLocality      = SuffixFrontendPassTLSClientCertInfosSubject + ".locality"
-	SuffixFrontendPassTLSClientCertInfosSubjectOrganization  = SuffixFrontendPassTLSClientCertInfosSubject + ".organization"
-	SuffixFrontendPassTLSClientCertInfosSubjectProvince      = SuffixFrontendPassTLSClientCertInfosSubject + ".province"
-	SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber  = SuffixFrontendPassTLSClientCertInfosSubject + ".serialNumber"
-	SuffixFrontendPassTLSCert                                = "frontend.passTLSCert" // Deprecated
-	SuffixFrontendPriority                                   = "frontend.priority"
-	SuffixFrontendRateLimitExtractorFunc                     = "frontend.rateLimit.extractorFunc"
-	SuffixFrontendRedirectEntryPoint                         = "frontend.redirect.entryPoint"
-	SuffixFrontendRedirectRegex                              = "frontend.redirect.regex"
-	SuffixFrontendRedirectReplacement                        = "frontend.redirect.replacement"
-	SuffixFrontendRedirectPermanent                          = "frontend.redirect.permanent"
-	SuffixFrontendRule                                       = "frontend.rule"
-	SuffixFrontendWhitelistSourceRange                       = "frontend.whitelistSourceRange" // Deprecated
-	SuffixFrontendWhiteList                                  = "frontend.whiteList."
-	SuffixFrontendWhiteListSourceRange                       = SuffixFrontendWhiteList + "sourceRange"
-	SuffixFrontendWhiteListUseXForwardedFor                  = SuffixFrontendWhiteList + "useXForwardedFor"
-	TraefikDomain                                            = Prefix + SuffixDomain
-	TraefikEnable                                            = Prefix + SuffixEnable
-	TraefikPort                                              = Prefix + SuffixPort
-	TraefikPortName                                          = Prefix + SuffixPortName
-	TraefikPortIndex                                         = Prefix + SuffixPortIndex
-	TraefikProtocol                                          = Prefix + SuffixProtocol
-	TraefikTags                                              = Prefix + SuffixTags
-	TraefikWeight                                            = Prefix + SuffixWeight
-	TraefikBackend                                           = Prefix + SuffixBackend
-	TraefikBackendID                                         = Prefix + SuffixBackendID
-	TraefikBackendCircuitBreaker                             = Prefix + SuffixBackendCircuitBreaker
-	TraefikBackendCircuitBreakerExpression                   = Prefix + SuffixBackendCircuitBreakerExpression
-	TraefikBackendHealthCheckScheme                          = Prefix + SuffixBackendHealthCheckScheme
-	TraefikBackendHealthCheckPath                            = Prefix + SuffixBackendHealthCheckPath
-	TraefikBackendHealthCheckPort                            = Prefix + SuffixBackendHealthCheckPort
-	TraefikBackendHealthCheckInterval                        = Prefix + SuffixBackendHealthCheckInterval
-	TraefikBackendHealthCheckHostname                        = Prefix + SuffixBackendHealthCheckHostname
-	TraefikBackendHealthCheckHeaders                         = Prefix + SuffixBackendHealthCheckHeaders
-	TraefikBackendLoadBalancer                               = Prefix + SuffixBackendLoadBalancer
-	TraefikBackendLoadBalancerMethod                         = Prefix + SuffixBackendLoadBalancerMethod
-	TraefikBackendLoadBalancerSticky                         = Prefix + SuffixBackendLoadBalancerSticky
-	TraefikBackendLoadBalancerStickiness                     = Prefix + SuffixBackendLoadBalancerStickiness
-	TraefikBackendLoadBalancerStickinessCookieName           = Prefix + SuffixBackendLoadBalancerStickinessCookieName
-	TraefikBackendMaxConnAmount                              = Prefix + SuffixBackendMaxConnAmount
-	TraefikBackendMaxConnExtractorFunc                       = Prefix + SuffixBackendMaxConnExtractorFunc
-	TraefikBackendBuffering                                  = Prefix + SuffixBackendBuffering
-	TraefikBackendResponseForwardingFlushInterval            = Prefix + SuffixBackendResponseForwardingFlushInterval
-	TraefikBackendBufferingMaxRequestBodyBytes               = Prefix + SuffixBackendBufferingMaxRequestBodyBytes
-	TraefikBackendBufferingMemRequestBodyBytes               = Prefix + SuffixBackendBufferingMemRequestBodyBytes
-	TraefikBackendBufferingMaxResponseBodyBytes              = Prefix + SuffixBackendBufferingMaxResponseBodyBytes
-	TraefikBackendBufferingMemResponseBodyBytes              = Prefix + SuffixBackendBufferingMemResponseBodyBytes
-	TraefikBackendBufferingRetryExpression                   = Prefix + SuffixBackendBufferingRetryExpression
-	TraefikFrontend                                          = Prefix + SuffixFrontend
-	TraefikFrontendAuth                                      = Prefix + SuffixFrontendAuth
-	TraefikFrontendAuthBasic                                 = Prefix + SuffixFrontendAuthBasic
-	TraefikFrontendAuthBasicRemoveHeader                     = Prefix + SuffixFrontendAuthBasicRemoveHeader
-	TraefikFrontendAuthBasicUsers                            = Prefix + SuffixFrontendAuthBasicUsers
-	TraefikFrontendAuthBasicUsersFile                        = Prefix + SuffixFrontendAuthBasicUsersFile
-	TraefikFrontendAuthDigest                                = Prefix + SuffixFrontendAuthDigest
-	TraefikFrontendAuthDigestRemoveHeader                    = Prefix + SuffixFrontendAuthDigestRemoveHeader
-	TraefikFrontendAuthDigestUsers                           = Prefix + SuffixFrontendAuthDigestUsers
-	TraefikFrontendAuthDigestUsersFile                       = Prefix + SuffixFrontendAuthDigestUsersFile
-	TraefikFrontendAuthForward                               = Prefix + SuffixFrontendAuthForward
-	TraefikFrontendAuthForwardAddress                        = Prefix + SuffixFrontendAuthForwardAddress
-	TraefikFrontendAuthForwardAuthResponseHeaders            = Prefix + SuffixFrontendAuthForwardAuthResponseHeaders
-	TraefikFrontendAuthForwardTLS                            = Prefix + SuffixFrontendAuthForwardTLS
-	TraefikFrontendAuthForwardTLSCa                          = Prefix + SuffixFrontendAuthForwardTLSCa
-	TraefikFrontendAuthForwardTLSCaOptional                  = Prefix + SuffixFrontendAuthForwardTLSCaOptional
-	TraefikFrontendAuthForwardTLSCert                        = Prefix + SuffixFrontendAuthForwardTLSCert
-	TraefikFrontendAuthForwardTLSInsecureSkipVerify          = Prefix + SuffixFrontendAuthForwardTLSInsecureSkipVerify
-	TraefikFrontendAuthForwardTLSKey                         = Prefix + SuffixFrontendAuthForwardTLSKey
-	TraefikFrontendAuthForwardTrustForwardHeader             = Prefix + SuffixFrontendAuthForwardTrustForwardHeader
-	TraefikFrontendAuthHeaderField                           = Prefix + SuffixFrontendAuthHeaderField
-	TraefikFrontendEntryPoints                               = Prefix + SuffixFrontendEntryPoints
-	TraefikFrontendPassHostHeader                            = Prefix + SuffixFrontendPassHostHeader
-	TraefikFrontendPassTLSClientCert                         = Prefix + SuffixFrontendPassTLSClientCert
-	TraefikFrontendPassTLSClientCertPem                      = Prefix + SuffixFrontendPassTLSClientCertPem
-	TraefikFrontendPassTLSClientCertInfos                    = Prefix + SuffixFrontendPassTLSClientCertInfos
-	TraefikFrontendPassTLSClientCertInfosNotAfter            = Prefix + SuffixFrontendPassTLSClientCertInfosNotAfter
-	TraefikFrontendPassTLSClientCertInfosNotBefore           = Prefix + SuffixFrontendPassTLSClientCertInfosNotBefore
-	TraefikFrontendPassTLSClientCertInfosSans                = Prefix + SuffixFrontendPassTLSClientCertInfosSans
-	TraefikFrontendPassTLSClientCertInfosSubject             = Prefix + SuffixFrontendPassTLSClientCertInfosSubject
-	TraefikFrontendPassTLSClientCertInfosSubjectCommonName   = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectCommonName
-	TraefikFrontendPassTLSClientCertInfosSubjectCountry      = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectCountry
-	TraefikFrontendPassTLSClientCertInfosSubjectLocality     = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectLocality
-	TraefikFrontendPassTLSClientCertInfosSubjectOrganization = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectOrganization
-	TraefikFrontendPassTLSClientCertInfosSubjectProvince     = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectProvince
-	TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber
-	TraefikFrontendPassTLSCert                               = Prefix + SuffixFrontendPassTLSCert // Deprecated
-	TraefikFrontendPriority                                  = Prefix + SuffixFrontendPriority
-	TraefikFrontendRateLimitExtractorFunc                    = Prefix + SuffixFrontendRateLimitExtractorFunc
-	TraefikFrontendRedirectEntryPoint                        = Prefix + SuffixFrontendRedirectEntryPoint
-	TraefikFrontendRedirectRegex                             = Prefix + SuffixFrontendRedirectRegex
-	TraefikFrontendRedirectReplacement                       = Prefix + SuffixFrontendRedirectReplacement
-	TraefikFrontendRedirectPermanent                         = Prefix + SuffixFrontendRedirectPermanent
-	TraefikFrontendRule                                      = Prefix + SuffixFrontendRule
-	TraefikFrontendWhitelistSourceRange                      = Prefix + SuffixFrontendWhitelistSourceRange // Deprecated
-	TraefikFrontendWhiteListSourceRange                      = Prefix + SuffixFrontendWhiteListSourceRange
-	TraefikFrontendWhiteListUseXForwardedFor                 = Prefix + SuffixFrontendWhiteListUseXForwardedFor
-	TraefikFrontendRequestHeaders                            = Prefix + SuffixFrontendRequestHeaders
-	TraefikFrontendResponseHeaders                           = Prefix + SuffixFrontendResponseHeaders
-	TraefikFrontendAllowedHosts                              = Prefix + SuffixFrontendHeadersAllowedHosts
-	TraefikFrontendHostsProxyHeaders                         = Prefix + SuffixFrontendHeadersHostsProxyHeaders
-	TraefikFrontendSSLForceHost                              = Prefix + SuffixFrontendHeadersSSLForceHost
-	TraefikFrontendSSLRedirect                               = Prefix + SuffixFrontendHeadersSSLRedirect
-	TraefikFrontendSSLTemporaryRedirect                      = Prefix + SuffixFrontendHeadersSSLTemporaryRedirect
-	TraefikFrontendSSLHost                                   = Prefix + SuffixFrontendHeadersSSLHost
-	TraefikFrontendSSLProxyHeaders                           = Prefix + SuffixFrontendHeadersSSLProxyHeaders
-	TraefikFrontendSTSSeconds                                = Prefix + SuffixFrontendHeadersSTSSeconds
-	TraefikFrontendSTSIncludeSubdomains                      = Prefix + SuffixFrontendHeadersSTSIncludeSubdomains
-	TraefikFrontendSTSPreload                                = Prefix + SuffixFrontendHeadersSTSPreload
-	TraefikFrontendForceSTSHeader                            = Prefix + SuffixFrontendHeadersForceSTSHeader
-	TraefikFrontendFrameDeny                                 = Prefix + SuffixFrontendHeadersFrameDeny
-	TraefikFrontendCustomFrameOptionsValue                   = Prefix + SuffixFrontendHeadersCustomFrameOptionsValue
-	TraefikFrontendContentTypeNosniff                        = Prefix + SuffixFrontendHeadersContentTypeNosniff
-	TraefikFrontendBrowserXSSFilter                          = Prefix + SuffixFrontendHeadersBrowserXSSFilter
-	TraefikFrontendCustomBrowserXSSValue                     = Prefix + SuffixFrontendHeadersCustomBrowserXSSValue
-	TraefikFrontendContentSecurityPolicy                     = Prefix + SuffixFrontendHeadersContentSecurityPolicy
-	TraefikFrontendPublicKey                                 = Prefix + SuffixFrontendHeadersPublicKey
-	TraefikFrontendReferrerPolicy                            = Prefix + SuffixFrontendHeadersReferrerPolicy
-	TraefikFrontendIsDevelopment                             = Prefix + SuffixFrontendHeadersIsDevelopment
-	BaseFrontendErrorPage                                    = "frontend.errors."
-	SuffixErrorPageBackend                                   = "backend"
-	SuffixErrorPageQuery                                     = "query"
-	SuffixErrorPageStatus                                    = "status"
-	BaseFrontendRateLimit                                    = "frontend.rateLimit.rateSet."
-	SuffixRateLimitPeriod                                    = "period"
-	SuffixRateLimitAverage                                   = "average"
-	SuffixRateLimitBurst                                     = "burst"
+	Prefix                                                      = "traefik."
+	SuffixBackend                                               = "backend"
+	SuffixDomain                                                = "domain"
+	SuffixEnable                                                = "enable"
+	SuffixPort                                                  = "port"
+	SuffixPortName                                              = "portName"
+	SuffixPortIndex                                             = "portIndex"
+	SuffixProtocol                                              = "protocol"
+	SuffixTags                                                  = "tags"
+	SuffixWeight                                                = "weight"
+	SuffixBackendID                                             = "backend.id"
+	SuffixBackendCircuitBreaker                                 = "backend.circuitbreaker"
+	SuffixBackendCircuitBreakerExpression                       = "backend.circuitbreaker.expression"
+	SuffixBackendHealthCheckScheme                              = "backend.healthcheck.scheme"
+	SuffixBackendHealthCheckPath                                = "backend.healthcheck.path"
+	SuffixBackendHealthCheckPort                                = "backend.healthcheck.port"
+	SuffixBackendHealthCheckInterval                            = "backend.healthcheck.interval"
+	SuffixBackendHealthCheckHostname                            = "backend.healthcheck.hostname"
+	SuffixBackendHealthCheckHeaders                             = "backend.healthcheck.headers"
+	SuffixBackendLoadBalancer                                   = "backend.loadbalancer"
+	SuffixBackendLoadBalancerMethod                             = SuffixBackendLoadBalancer + ".method"
+	SuffixBackendLoadBalancerSticky                             = SuffixBackendLoadBalancer + ".sticky"
+	SuffixBackendLoadBalancerStickiness                         = SuffixBackendLoadBalancer + ".stickiness"
+	SuffixBackendLoadBalancerStickinessCookieName               = SuffixBackendLoadBalancer + ".stickiness.cookieName"
+	SuffixBackendMaxConnAmount                                  = "backend.maxconn.amount"
+	SuffixBackendMaxConnExtractorFunc                           = "backend.maxconn.extractorfunc"
+	SuffixBackendBuffering                                      = "backend.buffering"
+	SuffixBackendResponseForwardingFlushInterval                = "backend.responseForwarding.flushInterval"
+	SuffixBackendBufferingMaxRequestBodyBytes                   = SuffixBackendBuffering + ".maxRequestBodyBytes"
+	SuffixBackendBufferingMemRequestBodyBytes                   = SuffixBackendBuffering + ".memRequestBodyBytes"
+	SuffixBackendBufferingMaxResponseBodyBytes                  = SuffixBackendBuffering + ".maxResponseBodyBytes"
+	SuffixBackendBufferingMemResponseBodyBytes                  = SuffixBackendBuffering + ".memResponseBodyBytes"
+	SuffixBackendBufferingRetryExpression                       = SuffixBackendBuffering + ".retryExpression"
+	SuffixFrontend                                              = "frontend"
+	SuffixFrontendAuth                                          = SuffixFrontend + ".auth"
+	SuffixFrontendAuthBasic                                     = SuffixFrontendAuth + ".basic"
+	SuffixFrontendAuthBasicRemoveHeader                         = SuffixFrontendAuthBasic + ".removeHeader"
+	SuffixFrontendAuthBasicUsers                                = SuffixFrontendAuthBasic + ".users"
+	SuffixFrontendAuthBasicUsersFile                            = SuffixFrontendAuthBasic + ".usersFile"
+	SuffixFrontendAuthDigest                                    = SuffixFrontendAuth + ".digest"
+	SuffixFrontendAuthDigestRemoveHeader                        = SuffixFrontendAuthDigest + ".removeHeader"
+	SuffixFrontendAuthDigestUsers                               = SuffixFrontendAuthDigest + ".users"
+	SuffixFrontendAuthDigestUsersFile                           = SuffixFrontendAuthDigest + ".usersFile"
+	SuffixFrontendAuthForward                                   = SuffixFrontendAuth + ".forward"
+	SuffixFrontendAuthForwardAddress                            = SuffixFrontendAuthForward + ".address"
+	SuffixFrontendAuthForwardAuthResponseHeaders                = SuffixFrontendAuthForward + ".authResponseHeaders"
+	SuffixFrontendAuthForwardTLS                                = SuffixFrontendAuthForward + ".tls"
+	SuffixFrontendAuthForwardTLSCa                              = SuffixFrontendAuthForwardTLS + ".ca"
+	SuffixFrontendAuthForwardTLSCaOptional                      = SuffixFrontendAuthForwardTLS + ".caOptional"
+	SuffixFrontendAuthForwardTLSCert                            = SuffixFrontendAuthForwardTLS + ".cert"
+	SuffixFrontendAuthForwardTLSInsecureSkipVerify              = SuffixFrontendAuthForwardTLS + ".insecureSkipVerify"
+	SuffixFrontendAuthForwardTLSKey                             = SuffixFrontendAuthForwardTLS + ".key"
+	SuffixFrontendAuthForwardTrustForwardHeader                 = SuffixFrontendAuthForward + ".trustForwardHeader"
+	SuffixFrontendAuthHeaderField                               = SuffixFrontendAuth + ".headerField"
+	SuffixFrontendEntryPoints                                   = "frontend.entryPoints"
+	SuffixFrontendHeaders                                       = "frontend.headers."
+	SuffixFrontendRequestHeaders                                = SuffixFrontendHeaders + "customRequestHeaders"
+	SuffixFrontendResponseHeaders                               = SuffixFrontendHeaders + "customResponseHeaders"
+	SuffixFrontendHeadersAllowedHosts                           = SuffixFrontendHeaders + "allowedHosts"
+	SuffixFrontendHeadersHostsProxyHeaders                      = SuffixFrontendHeaders + "hostsProxyHeaders"
+	SuffixFrontendHeadersSSLForceHost                           = SuffixFrontendHeaders + "SSLForceHost"
+	SuffixFrontendHeadersSSLRedirect                            = SuffixFrontendHeaders + "SSLRedirect"
+	SuffixFrontendHeadersSSLTemporaryRedirect                   = SuffixFrontendHeaders + "SSLTemporaryRedirect"
+	SuffixFrontendHeadersSSLHost                                = SuffixFrontendHeaders + "SSLHost"
+	SuffixFrontendHeadersSSLProxyHeaders                        = SuffixFrontendHeaders + "SSLProxyHeaders"
+	SuffixFrontendHeadersSTSSeconds                             = SuffixFrontendHeaders + "STSSeconds"
+	SuffixFrontendHeadersSTSIncludeSubdomains                   = SuffixFrontendHeaders + "STSIncludeSubdomains"
+	SuffixFrontendHeadersSTSPreload                             = SuffixFrontendHeaders + "STSPreload"
+	SuffixFrontendHeadersForceSTSHeader                         = SuffixFrontendHeaders + "forceSTSHeader"
+	SuffixFrontendHeadersFrameDeny                              = SuffixFrontendHeaders + "frameDeny"
+	SuffixFrontendHeadersCustomFrameOptionsValue                = SuffixFrontendHeaders + "customFrameOptionsValue"
+	SuffixFrontendHeadersContentTypeNosniff                     = SuffixFrontendHeaders + "contentTypeNosniff"
+	SuffixFrontendHeadersBrowserXSSFilter                       = SuffixFrontendHeaders + "browserXSSFilter"
+	SuffixFrontendHeadersCustomBrowserXSSValue                  = SuffixFrontendHeaders + "customBrowserXSSValue"
+	SuffixFrontendHeadersContentSecurityPolicy                  = SuffixFrontendHeaders + "contentSecurityPolicy"
+	SuffixFrontendHeadersPublicKey                              = SuffixFrontendHeaders + "publicKey"
+	SuffixFrontendHeadersReferrerPolicy                         = SuffixFrontendHeaders + "referrerPolicy"
+	SuffixFrontendHeadersIsDevelopment                          = SuffixFrontendHeaders + "isDevelopment"
+	SuffixFrontendPassHostHeader                                = "frontend.passHostHeader"
+	SuffixFrontendPassTLSClientCert                             = "frontend.passTLSClientCert"
+	SuffixFrontendPassTLSClientCertPem                          = SuffixFrontendPassTLSClientCert + ".pem"
+	SuffixFrontendPassTLSClientCertInfos                        = SuffixFrontendPassTLSClientCert + ".infos"
+	SuffixFrontendPassTLSClientCertInfosIssuer                  = SuffixFrontendPassTLSClientCertInfos + ".issuer"
+	SuffixFrontendPassTLSClientCertInfosIssuerCommonName        = SuffixFrontendPassTLSClientCertInfosIssuer + ".commonName"
+	SuffixFrontendPassTLSClientCertInfosIssuerCountry           = SuffixFrontendPassTLSClientCertInfosIssuer + ".country"
+	SuffixFrontendPassTLSClientCertInfosIssuerDomainComponent   = SuffixFrontendPassTLSClientCertInfosIssuer + ".domainComponent"
+	SuffixFrontendPassTLSClientCertInfosIssuerLocality          = SuffixFrontendPassTLSClientCertInfosIssuer + ".locality"
+	SuffixFrontendPassTLSClientCertInfosIssuerOrganization      = SuffixFrontendPassTLSClientCertInfosIssuer + ".organization"
+	SuffixFrontendPassTLSClientCertInfosIssuerProvince          = SuffixFrontendPassTLSClientCertInfosIssuer + ".province"
+	SuffixFrontendPassTLSClientCertInfosIssuerSerialNumber      = SuffixFrontendPassTLSClientCertInfosIssuer + ".serialNumber"
+	SuffixFrontendPassTLSClientCertInfosSubject                 = SuffixFrontendPassTLSClientCertInfos + ".subject"
+	SuffixFrontendPassTLSClientCertInfosNotAfter                = SuffixFrontendPassTLSClientCertInfos + ".notAfter"
+	SuffixFrontendPassTLSClientCertInfosNotBefore               = SuffixFrontendPassTLSClientCertInfos + ".notBefore"
+	SuffixFrontendPassTLSClientCertInfosSans                    = SuffixFrontendPassTLSClientCertInfos + ".sans"
+	SuffixFrontendPassTLSClientCertInfosSubjectCommonName       = SuffixFrontendPassTLSClientCertInfosSubject + ".commonName"
+	SuffixFrontendPassTLSClientCertInfosSubjectCountry          = SuffixFrontendPassTLSClientCertInfosSubject + ".country"
+	SuffixFrontendPassTLSClientCertInfosSubjectDomainComponent  = SuffixFrontendPassTLSClientCertInfosSubject + ".domainComponent"
+	SuffixFrontendPassTLSClientCertInfosSubjectLocality         = SuffixFrontendPassTLSClientCertInfosSubject + ".locality"
+	SuffixFrontendPassTLSClientCertInfosSubjectOrganization     = SuffixFrontendPassTLSClientCertInfosSubject + ".organization"
+	SuffixFrontendPassTLSClientCertInfosSubjectProvince         = SuffixFrontendPassTLSClientCertInfosSubject + ".province"
+	SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber     = SuffixFrontendPassTLSClientCertInfosSubject + ".serialNumber"
+	SuffixFrontendPassTLSCert                                   = "frontend.passTLSCert" // Deprecated
+	SuffixFrontendPriority                                      = "frontend.priority"
+	SuffixFrontendRateLimitExtractorFunc                        = "frontend.rateLimit.extractorFunc"
+	SuffixFrontendRedirectEntryPoint                            = "frontend.redirect.entryPoint"
+	SuffixFrontendRedirectRegex                                 = "frontend.redirect.regex"
+	SuffixFrontendRedirectReplacement                           = "frontend.redirect.replacement"
+	SuffixFrontendRedirectPermanent                             = "frontend.redirect.permanent"
+	SuffixFrontendRule                                          = "frontend.rule"
+	SuffixFrontendWhitelistSourceRange                          = "frontend.whitelistSourceRange" // Deprecated
+	SuffixFrontendWhiteList                                     = "frontend.whiteList."
+	SuffixFrontendWhiteListSourceRange                          = SuffixFrontendWhiteList + "sourceRange"
+	SuffixFrontendWhiteListUseXForwardedFor                     = SuffixFrontendWhiteList + "useXForwardedFor"
+	TraefikDomain                                               = Prefix + SuffixDomain
+	TraefikEnable                                               = Prefix + SuffixEnable
+	TraefikPort                                                 = Prefix + SuffixPort
+	TraefikPortName                                             = Prefix + SuffixPortName
+	TraefikPortIndex                                            = Prefix + SuffixPortIndex
+	TraefikProtocol                                             = Prefix + SuffixProtocol
+	TraefikTags                                                 = Prefix + SuffixTags
+	TraefikWeight                                               = Prefix + SuffixWeight
+	TraefikBackend                                              = Prefix + SuffixBackend
+	TraefikBackendID                                            = Prefix + SuffixBackendID
+	TraefikBackendCircuitBreaker                                = Prefix + SuffixBackendCircuitBreaker
+	TraefikBackendCircuitBreakerExpression                      = Prefix + SuffixBackendCircuitBreakerExpression
+	TraefikBackendHealthCheckScheme                             = Prefix + SuffixBackendHealthCheckScheme
+	TraefikBackendHealthCheckPath                               = Prefix + SuffixBackendHealthCheckPath
+	TraefikBackendHealthCheckPort                               = Prefix + SuffixBackendHealthCheckPort
+	TraefikBackendHealthCheckInterval                           = Prefix + SuffixBackendHealthCheckInterval
+	TraefikBackendHealthCheckHostname                           = Prefix + SuffixBackendHealthCheckHostname
+	TraefikBackendHealthCheckHeaders                            = Prefix + SuffixBackendHealthCheckHeaders
+	TraefikBackendLoadBalancer                                  = Prefix + SuffixBackendLoadBalancer
+	TraefikBackendLoadBalancerMethod                            = Prefix + SuffixBackendLoadBalancerMethod
+	TraefikBackendLoadBalancerSticky                            = Prefix + SuffixBackendLoadBalancerSticky
+	TraefikBackendLoadBalancerStickiness                        = Prefix + SuffixBackendLoadBalancerStickiness
+	TraefikBackendLoadBalancerStickinessCookieName              = Prefix + SuffixBackendLoadBalancerStickinessCookieName
+	TraefikBackendMaxConnAmount                                 = Prefix + SuffixBackendMaxConnAmount
+	TraefikBackendMaxConnExtractorFunc                          = Prefix + SuffixBackendMaxConnExtractorFunc
+	TraefikBackendBuffering                                     = Prefix + SuffixBackendBuffering
+	TraefikBackendResponseForwardingFlushInterval               = Prefix + SuffixBackendResponseForwardingFlushInterval
+	TraefikBackendBufferingMaxRequestBodyBytes                  = Prefix + SuffixBackendBufferingMaxRequestBodyBytes
+	TraefikBackendBufferingMemRequestBodyBytes                  = Prefix + SuffixBackendBufferingMemRequestBodyBytes
+	TraefikBackendBufferingMaxResponseBodyBytes                 = Prefix + SuffixBackendBufferingMaxResponseBodyBytes
+	TraefikBackendBufferingMemResponseBodyBytes                 = Prefix + SuffixBackendBufferingMemResponseBodyBytes
+	TraefikBackendBufferingRetryExpression                      = Prefix + SuffixBackendBufferingRetryExpression
+	TraefikFrontend                                             = Prefix + SuffixFrontend
+	TraefikFrontendAuth                                         = Prefix + SuffixFrontendAuth
+	TraefikFrontendAuthBasic                                    = Prefix + SuffixFrontendAuthBasic
+	TraefikFrontendAuthBasicRemoveHeader                        = Prefix + SuffixFrontendAuthBasicRemoveHeader
+	TraefikFrontendAuthBasicUsers                               = Prefix + SuffixFrontendAuthBasicUsers
+	TraefikFrontendAuthBasicUsersFile                           = Prefix + SuffixFrontendAuthBasicUsersFile
+	TraefikFrontendAuthDigest                                   = Prefix + SuffixFrontendAuthDigest
+	TraefikFrontendAuthDigestRemoveHeader                       = Prefix + SuffixFrontendAuthDigestRemoveHeader
+	TraefikFrontendAuthDigestUsers                              = Prefix + SuffixFrontendAuthDigestUsers
+	TraefikFrontendAuthDigestUsersFile                          = Prefix + SuffixFrontendAuthDigestUsersFile
+	TraefikFrontendAuthForward                                  = Prefix + SuffixFrontendAuthForward
+	TraefikFrontendAuthForwardAddress                           = Prefix + SuffixFrontendAuthForwardAddress
+	TraefikFrontendAuthForwardAuthResponseHeaders               = Prefix + SuffixFrontendAuthForwardAuthResponseHeaders
+	TraefikFrontendAuthForwardTLS                               = Prefix + SuffixFrontendAuthForwardTLS
+	TraefikFrontendAuthForwardTLSCa                             = Prefix + SuffixFrontendAuthForwardTLSCa
+	TraefikFrontendAuthForwardTLSCaOptional                     = Prefix + SuffixFrontendAuthForwardTLSCaOptional
+	TraefikFrontendAuthForwardTLSCert                           = Prefix + SuffixFrontendAuthForwardTLSCert
+	TraefikFrontendAuthForwardTLSInsecureSkipVerify             = Prefix + SuffixFrontendAuthForwardTLSInsecureSkipVerify
+	TraefikFrontendAuthForwardTLSKey                            = Prefix + SuffixFrontendAuthForwardTLSKey
+	TraefikFrontendAuthForwardTrustForwardHeader                = Prefix + SuffixFrontendAuthForwardTrustForwardHeader
+	TraefikFrontendAuthHeaderField                              = Prefix + SuffixFrontendAuthHeaderField
+	TraefikFrontendEntryPoints                                  = Prefix + SuffixFrontendEntryPoints
+	TraefikFrontendPassHostHeader                               = Prefix + SuffixFrontendPassHostHeader
+	TraefikFrontendPassTLSClientCert                            = Prefix + SuffixFrontendPassTLSClientCert
+	TraefikFrontendPassTLSClientCertPem                         = Prefix + SuffixFrontendPassTLSClientCertPem
+	TraefikFrontendPassTLSClientCertInfos                       = Prefix + SuffixFrontendPassTLSClientCertInfos
+	TraefikFrontendPassTLSClientCertInfosIssuer                 = Prefix + SuffixFrontendPassTLSClientCertInfosIssuer
+	TraefikFrontendPassTLSClientCertInfosIssuerCommonName       = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerCommonName
+	TraefikFrontendPassTLSClientCertInfosIssuerCountry          = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerCountry
+	TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent  = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerDomainComponent
+	TraefikFrontendPassTLSClientCertInfosIssuerLocality         = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerLocality
+	TraefikFrontendPassTLSClientCertInfosIssuerOrganization     = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerOrganization
+	TraefikFrontendPassTLSClientCertInfosIssuerProvince         = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerProvince
+	TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber     = Prefix + SuffixFrontendPassTLSClientCertInfosIssuerSerialNumber
+	TraefikFrontendPassTLSClientCertInfosNotAfter               = Prefix + SuffixFrontendPassTLSClientCertInfosNotAfter
+	TraefikFrontendPassTLSClientCertInfosNotBefore              = Prefix + SuffixFrontendPassTLSClientCertInfosNotBefore
+	TraefikFrontendPassTLSClientCertInfosSans                   = Prefix + SuffixFrontendPassTLSClientCertInfosSans
+	TraefikFrontendPassTLSClientCertInfosSubject                = Prefix + SuffixFrontendPassTLSClientCertInfosSubject
+	TraefikFrontendPassTLSClientCertInfosSubjectCommonName      = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectCommonName
+	TraefikFrontendPassTLSClientCertInfosSubjectCountry         = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectCountry
+	TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectDomainComponent
+	TraefikFrontendPassTLSClientCertInfosSubjectLocality        = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectLocality
+	TraefikFrontendPassTLSClientCertInfosSubjectOrganization    = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectOrganization
+	TraefikFrontendPassTLSClientCertInfosSubjectProvince        = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectProvince
+	TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber    = Prefix + SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber
+	TraefikFrontendPassTLSCert                                  = Prefix + SuffixFrontendPassTLSCert // Deprecated
+	TraefikFrontendPriority                                     = Prefix + SuffixFrontendPriority
+	TraefikFrontendRateLimitExtractorFunc                       = Prefix + SuffixFrontendRateLimitExtractorFunc
+	TraefikFrontendRedirectEntryPoint                           = Prefix + SuffixFrontendRedirectEntryPoint
+	TraefikFrontendRedirectRegex                                = Prefix + SuffixFrontendRedirectRegex
+	TraefikFrontendRedirectReplacement                          = Prefix + SuffixFrontendRedirectReplacement
+	TraefikFrontendRedirectPermanent                            = Prefix + SuffixFrontendRedirectPermanent
+	TraefikFrontendRule                                         = Prefix + SuffixFrontendRule
+	TraefikFrontendWhitelistSourceRange                         = Prefix + SuffixFrontendWhitelistSourceRange // Deprecated
+	TraefikFrontendWhiteListSourceRange                         = Prefix + SuffixFrontendWhiteListSourceRange
+	TraefikFrontendWhiteListUseXForwardedFor                    = Prefix + SuffixFrontendWhiteListUseXForwardedFor
+	TraefikFrontendRequestHeaders                               = Prefix + SuffixFrontendRequestHeaders
+	TraefikFrontendResponseHeaders                              = Prefix + SuffixFrontendResponseHeaders
+	TraefikFrontendAllowedHosts                                 = Prefix + SuffixFrontendHeadersAllowedHosts
+	TraefikFrontendHostsProxyHeaders                            = Prefix + SuffixFrontendHeadersHostsProxyHeaders
+	TraefikFrontendSSLForceHost                                 = Prefix + SuffixFrontendHeadersSSLForceHost
+	TraefikFrontendSSLRedirect                                  = Prefix + SuffixFrontendHeadersSSLRedirect
+	TraefikFrontendSSLTemporaryRedirect                         = Prefix + SuffixFrontendHeadersSSLTemporaryRedirect
+	TraefikFrontendSSLHost                                      = Prefix + SuffixFrontendHeadersSSLHost
+	TraefikFrontendSSLProxyHeaders                              = Prefix + SuffixFrontendHeadersSSLProxyHeaders
+	TraefikFrontendSTSSeconds                                   = Prefix + SuffixFrontendHeadersSTSSeconds
+	TraefikFrontendSTSIncludeSubdomains                         = Prefix + SuffixFrontendHeadersSTSIncludeSubdomains
+	TraefikFrontendSTSPreload                                   = Prefix + SuffixFrontendHeadersSTSPreload
+	TraefikFrontendForceSTSHeader                               = Prefix + SuffixFrontendHeadersForceSTSHeader
+	TraefikFrontendFrameDeny                                    = Prefix + SuffixFrontendHeadersFrameDeny
+	TraefikFrontendCustomFrameOptionsValue                      = Prefix + SuffixFrontendHeadersCustomFrameOptionsValue
+	TraefikFrontendContentTypeNosniff                           = Prefix + SuffixFrontendHeadersContentTypeNosniff
+	TraefikFrontendBrowserXSSFilter                             = Prefix + SuffixFrontendHeadersBrowserXSSFilter
+	TraefikFrontendCustomBrowserXSSValue                        = Prefix + SuffixFrontendHeadersCustomBrowserXSSValue
+	TraefikFrontendContentSecurityPolicy                        = Prefix + SuffixFrontendHeadersContentSecurityPolicy
+	TraefikFrontendPublicKey                                    = Prefix + SuffixFrontendHeadersPublicKey
+	TraefikFrontendReferrerPolicy                               = Prefix + SuffixFrontendHeadersReferrerPolicy
+	TraefikFrontendIsDevelopment                                = Prefix + SuffixFrontendHeadersIsDevelopment
+	BaseFrontendErrorPage                                       = "frontend.errors."
+	SuffixErrorPageBackend                                      = "backend"
+	SuffixErrorPageQuery                                        = "query"
+	SuffixErrorPageStatus                                       = "status"
+	BaseFrontendRateLimit                                       = "frontend.rateLimit.rateSet."
+	SuffixRateLimitPeriod                                       = "period"
+	SuffixRateLimitAverage                                      = "average"
+	SuffixRateLimitBurst                                        = "burst"
 )
--- a/provider/label/partial.go
+++ b/provider/label/partial.go
@@ -78,16 +78,30 @@ func GetTLSClientCert(labels map[string]string) *types.TLSClientHeaders {
 		}

 		if HasPrefix(labels, TraefikFrontendPassTLSClientCertInfosSubject) {
-			subject := &types.TLSCLientCertificateSubjectInfos{
-				CommonName:   GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectCommonName, false),
-				Country:      GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectCountry, false),
-				Locality:     GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectLocality, false),
-				Organization: GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectOrganization, false),
-				Province:     GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectProvince, false),
-				SerialNumber: GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber, false),
+			subject := &types.TLSCLientCertificateDNInfos{
+				CommonName:      GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectCommonName, false),
+				Country:         GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectCountry, false),
+				DomainComponent: GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent, false),
+				Locality:        GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectLocality, false),
+				Organization:    GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectOrganization, false),
+				Province:        GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectProvince, false),
+				SerialNumber:    GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber, false),
 			}
 			infos.Subject = subject
 		}
+
+		if HasPrefix(labels, TraefikFrontendPassTLSClientCertInfosIssuer) {
+			issuer := &types.TLSCLientCertificateDNInfos{
+				CommonName:      GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerCommonName, false),
+				Country:         GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerCountry, false),
+				DomainComponent: GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent, false),
+				Locality:        GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerLocality, false),
+				Organization:    GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerOrganization, false),
+				Province:        GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerProvince, false),
+				SerialNumber:    GetBoolValue(labels, TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber, false),
+			}
+			infos.Issuer = issuer
+		}
 		tlsClientHeaders.Infos = infos
 	}
 	return tlsClientHeaders
@@ -109,6 +123,8 @@ func GetAuth(labels map[string]string) *types.Auth {
 		auth.Digest = getAuthDigest(labels)
 	} else if HasPrefix(labels, TraefikFrontendAuthForward) {
 		auth.Forward = getAuthForward(labels)
+	} else {
+		return nil
 	}

 	return auth
--- a/provider/label/partial_test.go
+++ b/provider/label/partial_test.go
@@ -732,6 +732,13 @@ func TestGetAuth(t *testing.T) {
 			labels:   map[string]string{},
 			expected: nil,
 		},
+		{
+			desc: "should return nil when no real auth",
+			labels: map[string]string{
+				TraefikFrontendAuthHeaderField: "myHeaderField",
+			},
+			expected: nil,
+		},
 		{
 			desc: "should return a basic auth",
 			labels: map[string]string{
@@ -858,7 +865,7 @@ func TestGetPassTLSClientCert(t *testing.T) {
 			},
 			expected: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						CommonName: true,
 					},
 				},
@@ -871,7 +878,7 @@ func TestGetPassTLSClientCert(t *testing.T) {
 			},
 			expected: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						Country: true,
 					},
 				},
@@ -884,7 +891,7 @@ func TestGetPassTLSClientCert(t *testing.T) {
 			},
 			expected: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						Locality: true,
 					},
 				},
@@ -897,7 +904,7 @@ func TestGetPassTLSClientCert(t *testing.T) {
 			},
 			expected: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						Organization: true,
 					},
 				},
@@ -910,7 +917,7 @@ func TestGetPassTLSClientCert(t *testing.T) {
 			},
 			expected: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						Province: true,
 					},
 				},
@@ -923,7 +930,7 @@ func TestGetPassTLSClientCert(t *testing.T) {
 			},
 			expected: &types.TLSClientHeaders{
 				Infos: &types.TLSClientCertificateInfos{
-					Subject: &types.TLSCLientCertificateSubjectInfos{
+					Subject: &types.TLSCLientCertificateDNInfos{
 						SerialNumber: true,
 					},
 				},
@@ -932,16 +939,24 @@ func TestGetPassTLSClientCert(t *testing.T) {
 		{
 			desc: "should return tlsClientHeaders with all infos",
 			labels: map[string]string{
-				TraefikFrontendPassTLSClientCertPem:                      "true",
-				TraefikFrontendPassTLSClientCertInfosNotAfter:            "true",
-				TraefikFrontendPassTLSClientCertInfosNotBefore:           "true",
-				TraefikFrontendPassTLSClientCertInfosSans:                "true",
-				TraefikFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-				TraefikFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-				TraefikFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-				TraefikFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-				TraefikFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-				TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+				TraefikFrontendPassTLSClientCertPem:                         "true",
+				TraefikFrontendPassTLSClientCertInfosNotAfter:               "true",
+				TraefikFrontendPassTLSClientCertInfosNotBefore:              "true",
+				TraefikFrontendPassTLSClientCertInfosSans:                   "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+				TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+				TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",
 			},
 			expected: &types.TLSClientHeaders{
 				PEM: true,
@@ -949,13 +964,23 @@ func TestGetPassTLSClientCert(t *testing.T) {
 					Sans:      true,
 					NotBefore: true,
 					NotAfter:  true,
-					Subject: &types.TLSCLientCertificateSubjectInfos{
-						Province:     true,
-						Organization: true,
-						Locality:     true,
-						Country:      true,
-						CommonName:   true,
-						SerialNumber: true,
+					Subject: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
+					},
+					Issuer: &types.TLSCLientCertificateDNInfos{
+						CommonName:      true,
+						Country:         true,
+						DomainComponent: true,
+						Locality:        true,
+						Organization:    true,
+						Province:        true,
+						SerialNumber:    true,
 					},
 				},
 			},
--- a/provider/marathon/config_segment_test.go
+++ b/provider/marathon/config_segment_test.go
@@ -117,8 +117,16 @@ func TestBuildConfigurationSegments(t *testing.T) {
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosNotBefore, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosNotAfter, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSans, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCountry, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerLocality, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerProvince, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCountry, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectLocality, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectProvince, "true", "containous"),
@@ -211,13 +219,23 @@ func TestBuildConfigurationSegments(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/marathon/config_test.go
+++ b/provider/marathon/config_test.go
@@ -381,8 +381,16 @@ func TestBuildConfiguration(t *testing.T) {
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosNotBefore, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosNotAfter, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSans, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCountry, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerLocality, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerProvince, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCountry, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectLocality, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectProvince, "true"),
@@ -474,13 +482,23 @@ func TestBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/mesos/config_segment_test.go
+++ b/provider/mesos/config_segment_test.go
@@ -136,8 +136,16 @@ func TestBuildConfigurationSegments(t *testing.T) {
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosNotBefore, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosNotAfter, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSans, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCountry, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerLocality, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerProvince, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCountry, "true", "containous"),
+					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectLocality, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization, "true", "containous"),
 					withSegmentLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectProvince, "true", "containous"),
@@ -231,13 +239,23 @@ func TestBuildConfigurationSegments(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/mesos/config_test.go
+++ b/provider/mesos/config_test.go
@@ -337,8 +337,16 @@ func TestBuildConfiguration(t *testing.T) {
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosNotBefore, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosNotAfter, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSans, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerCountry, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerLocality, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerProvince, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectCountry, "true"),
+					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectLocality, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization, "true"),
 					withLabel(label.TraefikFrontendPassTLSClientCertInfosSubjectProvince, "true"),
@@ -437,13 +445,23 @@ func TestBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/provider/rancher/config_test.go
+++ b/provider/rancher/config_test.go
@@ -60,16 +60,24 @@ func TestProviderBuildConfiguration(t *testing.T) {
 						label.TraefikBackendBufferingMemRequestBodyBytes:     "2097152",
 						label.TraefikBackendBufferingRetryExpression:         "IsNetworkError() && Attempts() <= 2",

-						label.TraefikFrontendPassTLSClientCertPem:                      "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.TraefikFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.TraefikFrontendPassTLSClientCertInfosSans:                "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.TraefikFrontendPassTLSClientCertPem:                         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.TraefikFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.TraefikFrontendPassTLSClientCertInfosSans:                   "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.TraefikFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",

 						label.TraefikFrontendAuthBasic:                        "test:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/,test2:$apr1$d9hr9HBB$4HxwgUir3HP4EsggP/QNo0",
 						label.TraefikFrontendAuthBasicRemoveHeader:            "true",
@@ -162,13 +170,23 @@ func TestProviderBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
@@ -322,16 +340,24 @@ func TestProviderBuildConfiguration(t *testing.T) {
 						label.Prefix + "sauternes." + label.SuffixProtocol: "https",
 						label.Prefix + "sauternes." + label.SuffixWeight:   "12",

-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:            "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:           "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:   "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:      "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization: "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:     "true",
-						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerCommonName:       "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerCountry:          "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerDomainComponent:  "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerLocality:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerOrganization:     "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerProvince:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosIssuerSerialNumber:     "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertPem:                         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotAfter:               "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosNotBefore:              "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSans:                   "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCommonName:      "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectCountry:         "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectDomainComponent: "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectLocality:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectOrganization:    "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectProvince:        "true",
+						label.Prefix + "sauternes." + label.SuffixFrontendPassTLSClientCertInfosSubjectSerialNumber:    "true",

 						label.Prefix + "sauternes." + label.SuffixFrontendRule:                             "Host:traefik.wtf",
 						label.Prefix + "sauternes." + label.SuffixFrontendAuthBasicRemoveHeader:            "true",
@@ -420,13 +446,23 @@ func TestProviderBuildConfiguration(t *testing.T) {
 							NotBefore: true,
 							Sans:      true,
 							NotAfter:  true,
-							Subject: &types.TLSCLientCertificateSubjectInfos{
-								CommonName:   true,
-								Country:      true,
-								Locality:     true,
-								Organization: true,
-								Province:     true,
-								SerialNumber: true,
+							Subject: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
+							},
+							Issuer: &types.TLSCLientCertificateDNInfos{
+								CommonName:      true,
+								Country:         true,
+								DomainComponent: true,
+								Locality:        true,
+								Organization:    true,
+								Province:        true,
+								SerialNumber:    true,
 							},
 						},
 					},
--- a/script/docs-verify-docker-image/Dockerfile
+++ b/script/docs-verify-docker-image/Dockerfile
@@ -1,15 +1,16 @@
-FROM alpine:3.7
+FROM alpine:3.8

 RUN apk --no-cache --no-progress add \
    ca-certificates \
    curl \
    findutils \
    ruby-bigdecimal \
+    ruby-etc \
    ruby-ffi \
    ruby-json \
-    ruby-nokogiri \
+    ruby-nokogiri=1.8.3-r0 \
    tini \
-  && gem install --no-document html-proofer
+  && gem install --no-document html-proofer -v 3.9.3

 COPY ./validate.sh /validate.sh

--- a/script/docs-verify-docker-image/validate.sh
+++ b/script/docs-verify-docker-image/validate.sh
@@ -18,9 +18,10 @@ find "${PATH_TO_SITE}" -type f -not -path "/app/site/theme/*" \
 | xargs -0 -r -P "${NUMBER_OF_CPUS}" -I '{}' \
  htmlproofer \
  --check-html \
-  --only_4xx \
+  --check_external_hash \
  --alt_ignore="/traefik.logo.png/" \
-  --url-ignore "/localhost:/,/127.0.0.1:/,/fonts.gstatic.com/,/.minikube/,/github.com\/containous\/traefik\/*edit*/,/github.com\/containous\/traefik\/$/" \
+  --http_status_ignore="0,500,501,503" \
+  --url-ignore "/https://groups.google.com/a/traefik.io/forum/#!forum/security/,/localhost:/,/127.0.0.1:/,/fonts.gstatic.com/,/.minikube/,/github.com\/containous\/traefik\/*edit*/,/github.com\/containous\/traefik\/$/" \
  '{}'
 ## HTML-proofer options at https://github.com/gjtorikian/html-proofer#configuration

--- a/server/header_rewriter.go
+++ b/server/header_rewriter.go
@@ -7,6 +7,12 @@ import (
 	"github.com/containous/traefik/log"
 	"github.com/containous/traefik/whitelist"
 	"github.com/vulcand/oxy/forward"
+	"github.com/vulcand/oxy/utils"
+)
+
+const (
+	xForwardedURI    = "X-Forwarded-Uri"
+	xForwardedMethod = "X-Forwarded-Method"
 )

 // NewHeaderRewriter Create a header rewriter
@@ -45,6 +51,8 @@ func (h *headerRewriter) Rewrite(req *http.Request) {
 	err := h.ips.IsAuthorized(req)
 	if err != nil {
 		log.Debug(err)
+		// Remove additional X-Forwarded Headers which are used by the forward authentication
+		utils.RemoveHeaders(req.Header, xForwardedURI, xForwardedMethod)
 		h.secureRewriter.Rewrite(req)
 		return
 	}
--- a/server/header_rewriter_test.go
+++ b/server/header_rewriter_test.go
@@ -23,8 +23,10 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {
 			trustedIPs: []string{"10.10.10.10"},
 			insecure:   false,
 			expected: map[string]string{
-				"X-Foo":           "bar",
-				"X-Forwarded-For": "30.30.30.30",
+				"X-Foo":              "bar",
+				"X-Forwarded-For":    "30.30.30.30",
+				"X-Forwarded-Uri":    "/bar",
+				"X-Forwarded-Method": "GET",
 			},
 		},
 		{
@@ -33,8 +35,10 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {
 			trustedIPs: []string{"10.10.10.10"},
 			insecure:   false,
 			expected: map[string]string{
-				"X-Foo":           "bar",
-				"X-Forwarded-For": "",
+				"X-Foo":              "bar",
+				"X-Forwarded-For":    "",
+				"X-Forwarded-Uri":    "",
+				"X-Forwarded-Method": "",
 			},
 		},
 		{
@@ -43,8 +47,10 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {
 			trustedIPs: []string{"10.10.10.10"},
 			insecure:   false,
 			expected: map[string]string{
-				"X-Foo":           "bar",
-				"X-Forwarded-For": "",
+				"X-Foo":              "bar",
+				"X-Forwarded-For":    "",
+				"X-Forwarded-Uri":    "",
+				"X-Forwarded-Method": "",
 			},
 		},
 		{
@@ -53,8 +59,10 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {
 			trustedIPs: []string{"10.10.10.10"},
 			insecure:   true,
 			expected: map[string]string{
-				"X-Foo":           "bar",
-				"X-Forwarded-For": "30.30.30.30",
+				"X-Foo":              "bar",
+				"X-Forwarded-For":    "30.30.30.30",
+				"X-Forwarded-Uri":    "/bar",
+				"X-Forwarded-Method": "GET",
 			},
 		},
 		{
@@ -63,8 +71,10 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {
 			trustedIPs: []string{"10.10.10.10"},
 			insecure:   true,
 			expected: map[string]string{
-				"X-Foo":           "bar",
-				"X-Forwarded-For": "30.30.30.30",
+				"X-Foo":              "bar",
+				"X-Forwarded-For":    "30.30.30.30",
+				"X-Forwarded-Uri":    "/bar",
+				"X-Forwarded-Method": "GET",
 			},
 		},
 		{
@@ -73,8 +83,10 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {
 			trustedIPs: []string{"10.10.10.10"},
 			insecure:   true,
 			expected: map[string]string{
-				"X-Foo":           "bar",
-				"X-Forwarded-For": "30.30.30.30",
+				"X-Foo":              "bar",
+				"X-Forwarded-For":    "30.30.30.30",
+				"X-Forwarded-Uri":    "/bar",
+				"X-Forwarded-Method": "GET",
 			},
 		},
 	}
@@ -93,6 +105,8 @@ func TestHeaderRewriter_Rewrite(t *testing.T) {

 			req.Header.Set("X-Foo", "bar")
 			req.Header.Set("X-Forwarded-For", "30.30.30.30")
+			req.Header.Set("X-Forwarded-Uri", "/bar")
+			req.Header.Set("X-Forwarded-Method", "GET")

 			rewriter.Rewrite(req)

--- a/server/server.go
+++ b/server/server.go
@@ -13,6 +13,7 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
+	"strings"
 	"sync"
 	"time"

@@ -34,7 +35,7 @@ import (
 	"github.com/containous/traefik/whitelist"
 	"github.com/sirupsen/logrus"
 	"github.com/urfave/negroni"
-	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/challenge/tlsalpn01"
 )

 var httpServerLogger = stdlog.New(log.WriterLevel(logrus.DebugLevel), "", 0)
@@ -355,10 +356,14 @@ func (s *Server) listenProviders(stop chan bool) {
 		case <-stop:
 			return
 		case configMsg, ok := <-s.configurationChan:
-			if !ok || configMsg.Configuration == nil {
+			if !ok {
 				return
 			}
-			s.preLoadConfiguration(configMsg)
+			if configMsg.Configuration != nil {
+				s.preLoadConfiguration(configMsg)
+			} else {
+				log.Debugf("Received nil configuration from provider %q, skipping.", configMsg.ProviderName)
+			}
 		}
 	}
 }
@@ -434,7 +439,7 @@ func (s *Server) createTLSConfig(entryPointName string, tlsOption *traefiktls.TL
 	s.serverEntryPoints[entryPointName].certs.DynamicCerts.Set(make(map[string]*tls.Certificate))

 	// ensure http2 enabled
-	config.NextProtos = []string{"h2", "http/1.1", acme.ACMETLS1Protocol}
+	config.NextProtos = []string{"h2", "http/1.1", tlsalpn01.ACMETLS1Protocol}

 	if len(tlsOption.ClientCAFiles) > 0 {
 		log.Warnf("Deprecated configuration found during TLS configuration creation: %s. Please use %s (which allows to make the CA Files optional).", "tls.ClientCAFiles", "tls.ClientCA.files")
@@ -711,13 +716,13 @@ func (s *Server) buildNameOrIPToCertificate(certs []tls.Certificate) map[string]
 			continue
 		}
 		if len(x509Cert.Subject.CommonName) > 0 {
-			certMap[x509Cert.Subject.CommonName] = cert
+			certMap[strings.ToLower(x509Cert.Subject.CommonName)] = cert
 		}
 		for _, san := range x509Cert.DNSNames {
-			certMap[san] = cert
+			certMap[strings.ToLower(san)] = cert
 		}
 		for _, ipSan := range x509Cert.IPAddresses {
-			certMap[ipSan.String()] = cert
+			certMap[strings.ToLower(ipSan.String())] = cert
 		}
 	}
 	return certMap
--- a/templates/consul_catalog.tmpl
+++ b/templates/consul_catalog.tmpl
@@ -101,6 +101,18 @@
          organization = {{ $subject.Organization }}
          commonName = {{ $subject.CommonName }}
          serialNumber = {{ $subject.SerialNumber }}
+          domainComponent = {{ $subject.DomainComponent }}
+        {{end}}
+        {{ $issuer := $infos.Subject }}
+        {{if $issuer }}
+        [frontends."frontend-{{ $service.ServiceName }}".passTLSClientCert.infos.issuer]
+          country = {{ $issuer.Country }}
+          province = {{ $issuer.Province }}
+          locality = {{ $issuer.Locality }}
+          organization = {{ $issuer.Organization }}
+          commonName = {{ $issuer.CommonName }}
+          serialNumber = {{ $issuer.SerialNumber }}
+          domainComponent = {{ $issuer.DomainComponent }}
        {{end}}
      {{end}}
    {{end}}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ludovic Fernandez	418dca1113	Prepare release v1.7.8	2019-01-29 17:22:07 +01:00
Ludovic Fernandez	ed293e3058	Fixes docker swarm mode refresh second for KV.	2019-01-29 17:08:08 +01:00
Foivos Filippopoulos	40bb0cd879	Check for dynamic tls updates on configuration preload	2019-01-29 16:46:09 +01:00
Ludovic Fernandez	32f5e0df8f	Updates lego.	2019-01-25 10:24:04 +01:00
Maarten van der Hoef	40b8a93930	Generic awsvpc support, not just Fargate	2019-01-21 17:00:07 +01:00
hwhelan-CB	b52b0f58b9	Cache exising task definitions to avoid rate limiting	2019-01-19 08:56:02 +01:00
David Birks	0016db0856	Minor formatting fixes	2019-01-16 20:10:04 +01:00
Joost Cassee	5aeca4507e	Support Datadog tracer priority sampling	2019-01-16 17:08:06 +01:00
Thorsten	11bfb49e65	Route priorities: document minimum priority value	2019-01-16 16:44:05 +01:00
Dragnucs	d0cdb5608f	Note about quotes for entrypoint definition with docker-compose	2019-01-16 16:36:07 +01:00
Timo Reimann	8bb8ad5e02	Assert that test timeout service is ready.	2019-01-16 15:00:09 +01:00
rbq	b488d8365c	Allow Træfik to update Ingress status	2019-01-15 16:42:05 +01:00
Ludovic Fernandez	e2bd7b45d1	doc: more detailed info about Google Cloud DNS.	2019-01-15 16:30:08 +01:00
Tim Stackhouse	c8ea2ce703	Tested wildcard ACME challenge with DNSimple	2019-01-14 17:40:04 +01:00
Henri Larget	7d1edcd735	doc missing information about statistics parameter	2019-01-14 17:28:04 +01:00
Ishaan Bahal	9660c31d3d	Removed repeated entryPoints.http from grpc.md	2019-01-11 16:34:04 +01:00
Ludovic Fernandez	37ac19583a	fix: update lego.	2019-01-11 16:22:03 +01:00
Emile Vauge	ca60c52199	Happy 2019	2019-01-08 16:22:04 +01:00
Ludovic Fernandez	9cddf5616a	Prepare release v1.7.7	2019-01-08 10:52:03 +01:00
Jean-Baptiste Doumenjou	f8ba843ad2	Add Pass TLS Cert Issuer and Domain Component	2019-01-08 09:46:04 +01:00
Daniel Tomcej	e598d6bcca	Skip TLS section with no secret in Kubernetes ingress	2019-01-08 09:22:03 +01:00
Julien Levesy	52ec0e8d34	Retry middleware : store headers per attempts and propagate them when responding.	2019-01-07 23:18:03 +01:00
Jack	13c32dee11	Harden Traefik systemd service	2019-01-07 19:02:03 +01:00
Tim Möhlmann	6db120fd8e	Test and exit for jq error before domain loop	2019-01-07 18:50:04 +01:00
Ludovic Fernandez	b6b3a9ed7f	Update Lego	2019-01-07 18:30:06 +01:00
Radoslaw Wesolowski	b5a4d0797a	Redirection status codes for methods different than GET	2019-01-07 17:56:04 +01:00
Michael	9ec2887494	Fix html-proofer and nokogiri version	2019-01-07 17:28:03 +01:00
Asmir Mustafic	94de6eb7f2	Letsencrypt - Add info on httpreq format	2019-01-04 17:24:04 +01:00
Wim Fournier	0e643f06a3	Proposing a small update to documentation	2019-01-03 18:30:05 +01:00
Daniel Tomcej	4db0dd9a7f	Allow empty path with App-root annotation	2018-12-26 11:52:03 +01:00
Daniel Tomcej	ee19e66aba	Check for watched namespace before getting kubernetes objects	2018-12-26 11:30:05 +01:00
zarqman	16ed13ba6f	kubernetes: sort and uniq TLS secrets	2018-12-20 20:08:03 +01:00
Joost Cassee	8f5e972843	Update contributing docs: use dep version < 0.5.0	2018-12-20 17:38:04 +01:00
Damien Duportal	4b70ff82b9	Check for anchors (hashes) for external links on the documentation	2018-12-19 17:36:04 +01:00
Damien Duportal	1468e1f697	Rephrase the `traefik.backend` definition in documentation	2018-12-19 16:50:04 +01:00
Cleber Rech	7a963e75fd	Update broken link for Docker service constraints	2018-12-18 12:26:03 +01:00
Ludovic Fernandez	9203ba5f95	Prepare release v1.7.6	2018-12-14 04:42:03 +01:00
Wim Fournier	302849282c	Fix label segmentation when using custom prefix	2018-12-07 16:38:03 +01:00
Michael	2a227fa4c7	Prepare release v1.7.5	2018-12-03 11:34:04 +01:00
hwhelan-CB	31b80683c8	Filter ECS tasks by LastStatus before adding to list of service tasks	2018-12-03 10:54:07 +01:00
Michael	6aa040ad9f	Fix upgrade flaeg	2018-12-03 10:34:04 +01:00
SALLEYRON Julien	617de78d14	Fix unannonced trailers problem when body is empty	2018-11-30 16:56:03 +01:00
Ludovic Fernandez	44605731dc	Matcher associativity rule.	2018-11-30 09:08:03 +01:00
Thomas Krzero	9d26839e54	[docker backend] - Add config flag to set refreshSeconds for swarmmode ticker	2018-11-27 17:44:04 +01:00
Damien Duportal	7a93bcc869	Add a "Security Consideration" section in the Docker's backend section of the documentation	2018-11-27 13:54:04 +01:00
Gérald Croës	0840fd0f96	Log configuration errors from providers and keeps listening	2018-11-26 18:52:03 +01:00
Daniel Tomcej	4a5f5440d7	Implement Case-insensitive SNI matching	2018-11-26 10:38:03 +01:00
Ludovic Fernandez	479ee9af49	Fix partial declaration of authentication.	2018-11-22 16:52:03 +01:00
Siyu	ef6c1fac4b	Update swarm mode endpoint	2018-11-20 16:40:06 +01:00
Ludovic Fernandez	53201b65b0	fix: ACME spec and Cloudflare.	2018-11-16 16:40:04 +01:00
Julien Levesy	9cb4d56c03	Clarify swarm loadbalancer documentation	2018-11-15 19:46:03 +01:00
Michael	f25ebc7e3d	Query params in health check	2018-11-15 15:50:03 +01:00
Alex Antonov	4c25cda55f	Upgraded DD APM library	2018-11-15 11:16:03 +01:00
Shane Hanna	18962b61d6	Include an explicit list of kubernetes protocol annotations in docs.	2018-11-15 10:52:04 +01:00
Michael Terrington	d0aa993661	Improve kubernetes TLS user guide	2018-11-14 10:24:03 +01:00
Si Westcott	df688dba0e	frame-deny should be set to true to enable the header	2018-11-14 08:42:03 +01:00
Demian	69585c58cd	Allow usersFile comments	2018-11-12 17:28:04 +01:00
stffabi	b889b0191c	Remove X-Forwarded-Uri and X-Forwarded-Method from untrusted IP	2018-11-12 17:06:04 +01:00
SALLEYRON Julien	9b0586cba7	Verify ctx when we send configuration message in docker provider	2018-11-12 09:52:03 +01:00
Giorgio Comai	a20f5bda0b	Fix spelling in comment	2018-11-08 08:30:04 +01:00
Tobias Hernstig	28d5731b87	Documentation: Rename "admin panel" to "dashboard	2018-11-08 08:20:03 +01:00
Rouven Bauer	66486eacdc	ACME DNS provider is called `acme-dns`	2018-11-07 16:26:03 +01:00
Kim Min	2b82ed054c	Support canary weight for external name service	2018-11-06 07:48:02 +01:00
Michael	cd6f0c0ded	Fix ssl force host secure middleware	2018-10-31 15:00:09 +01:00