How to Configure Windows Sandbox Local Traefik TLSStore via XML in Windows 11

Configuring default TLS certificates, mutual TLS client authentication authorities, and cipher suites across edge ingress proxies requires isolated testing to ensure TLS handshakes pass strict validation without touching host system certificate stores. Traefik’s TLSStore configuration defines global and per-domain certificate stores. Windows Sandbox on Windows 11 provides an isolated container for validating TLS certificates safely.

Why Test TLSStore in Windows Sandbox

Testing self-signed certificates and custom cipher suite negotiations directly on host machines can pollute local certificate trust caches. Launching Traefik inside an isolated Windows Sandbox enables engineers to verify TLS 1.3 handshakes, certificate renewals, and default wildcard fallback behaviors without risking workstation security.

Authoring the Windows Sandbox WSB XML

Save the following XML document as TraefikTLSSandbox.wsb on your Windows 11 machine:

<Configuration>
  <VGpu>Default</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TraefikTLSStoreLab</HostFolder>
      <SandboxFolder>C:\TraefikTLSStoreLab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\TraefikTLSStoreLab\setup-tlsstore.ps1</Command>
  </LogonCommand>
</Configuration>

PowerShell Deployment Bootstrapper

Save the bootstrapping script as C:TraefikTLSStoreLabsetup-tlsstore.ps1:

Write-Host "Setting up Traefik TLSStore Lab..." -ForegroundColor Cyan

$Dir = "C:Traefik"
New-Item -ItemType Directory -Force -Path $Dir | Out-Null

$ZipUrl = "https://github.com/traefik/traefik/releases/download/v3.0.0/traefik_v3.0.0_windows_amd64.zip"
Invoke-WebRequest -Uri $ZipUrl -OutFile "$Dir	raefik.zip"
Expand-Archive -Path "$Dir	raefik.zip" -DestinationPath $Dir -Force

# Generate self-signed cert for testing
New-SelfSignedCertificate -DnsName "localhost", "api.local" -CertStoreLocation "cert:LocalMachineMy" | Out-Null

$Config = @"
tls:
  stores:
    default:
      defaultCertificate:
        certFile: "C:/Traefik/cert.crt"
        keyFile: "C:/Traefik/cert.key"
  options:
    default:
      minVersion: "VersionTLS13"
      sniStrict: true
"@

Set-Content -Path "$Dirdynamic_conf.yml" -Value $Config
Write-Host "Traefik TLSStore Configured for TLS 1.3 Strict SNI." -ForegroundColor Green

Testing TLS Handshakes

Launch the sandbox configuration and run curl requests against https://localhost. Confirm that Traefik enforces TLS 1.3 negotiations and presents the configured certificate correctly. Closing the sandbox leaves no residual certificate files.