How to Configure Windows Sandbox Local Traefik TLS Client CA via XML in Windows 11

Validating mutual TLS (mTLS) client certificate verification across edge reverse proxies requires configuring trusted Client Certificate Authority (Client CA) bundles. Traefik supports native client certificate verification policies (such as RequireAndVerifyClientCert). Windows Sandbox on Windows 11 provides a secure, disposable container for validating mTLS client CA authentication safely without altering host machine certificate stores.

Why Test TLS Client CA in Windows Sandbox

Testing client certificate authentication directly on developer workstations can pollute local certificate trust stores or conflict with existing Windows smartcard policies. Launching Traefik inside an isolated Windows Sandbox enables engineers to test client CA bundles, revocation lists (CRLs), and certificate chain verification safely.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikClientCASandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikClientCALab</HostFolder>
      <SandboxFolder>C:\TraefikClientCALab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikClientCALab\setup-clientca.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikClientCALabsetup-clientca.ps1:

Write-Host "Setting up Traefik TLS Client CA Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

$Config = @"
entryPoints:
  websecure:
    address: ":443"
tls:
  options:
    mtls-strict:
      minVersion: "VersionTLS12"
      clientAuth:
        caFiles:
          - "C:/Traefik/client-ca.crt"
        clientAuthType: "RequireAndVerifyClientCert"
"@

Set-Content -Path "$Dirdynamic_conf.yml" -Value $Config
Write-Host "Traefik TLS Options Configured for Strict Client CA Verification." -ForegroundColor Green

Testing Client Certificate Verification

Launch the sandbox configuration and run curl requests against port 443 with and without client certificate parameters. Confirm that unauthenticated requests receive TLS handshake failures, while valid client certificates succeed cleanly. Closing the sandbox leaves no residual certificate files.