# Globally enabled http to https blocks cert manager http challenge **URL:** \ **Category:** Traefik v2\ **Tags:** kubernetes-ingress\ **Created:** [October 2, 2023, 4:07pm UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047 "2023-10-02T16:07:55Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![AtomAnt](https://avatars.discourse-cdn.com/v4/letter/a/82dd89/32.png) [@AtomAnt](https://community.traefik.io/u/AtomAnt)\ **Post date:** [October 2, 2023, 4:07pm UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047/1 "2023-10-02T16:07:55Z")
Hi all, I've read many posts on similar subject but I couldn't find answer for my issue. I'm using traefik 2.10 with globally enabled http to https redirection since I have large k8s cluster with about 30+ applications with mix of http and https exposed ingresses, so global redirection comes in handy. However, I'm getting issue with ACME solver pods since our ACME server works only with http (not like letsencrypt which can handle https on http-01 challenges). In addition we can't switch to DNS challenge. So what can be done to overcome this issue since I couldn't find right approach to exclude .well-known/acme-challenge path from being redirected to https. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [October 2, 2023, 7:27pm UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047/2 "2023-10-02T19:27:14Z")
You can set `priority` on `entrypoint` and have a router that is higher (larger) to still forward plain http `.well-known/acme-challenge` to a service. It works, see [Traefik certbot proof-of-concept](https://community.letsencrypt.org/t/how-to-continuously-create-renew-certificates-without-hitting-limits/184562/25). ---
**Author:** ![AtomAnt](https://avatars.discourse-cdn.com/v4/letter/a/82dd89/32.png) [@AtomAnt](https://community.traefik.io/u/AtomAnt)\ **Post date:** [October 2, 2023, 8:01pm UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047/3 "2023-10-02T20:01:56Z")
Hmm, maybe this could be worth of try, but why do you say it's not production ready? ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [October 2, 2023, 8:03pm UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047/4 "2023-10-02T20:03:56Z")
The whole certbot script is just a hack. TLS is supplied by http to the Traefik instances, reloaded every 15 seconds. If there is an issue with certbot in that scenario, suddenly TLS is gone. ---
**Author:** ![AtomAnt](https://avatars.discourse-cdn.com/v4/letter/a/82dd89/32.png) [@AtomAnt](https://community.traefik.io/u/AtomAnt)\ **Post date:** [October 2, 2023, 8:08pm UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047/5 "2023-10-02T20:08:31Z")
Thanks for help, but I need more proven and stable solution since this is production cluster. I can't imagine that someone didn't solve this since I've seen many posts, but no concrete solution ☹ ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [October 3, 2023, 7:49am UTC](https://community.traefik.io/t/globally-enabled-http-to-https-blocks-cert-manager-http-challenge/20047/6 "2023-10-03T07:49:46Z")
Traefik and setting priority is very stable 🙂