And also a follow up on my traefik story, where an upgrade of the go version dropped the defaults for TLS connections down to SSLv3, instead of TLS1.0.
The wonderful team around traefik solved the problem and released a new version within 2 days:
https://github.com/containous/traefik/releases/tag/v1.7.15
That's how things should work!