I think we've had the same problem here before. Unfortunately I can't find the link to it. But the solution was probably to set the tls option not in the router (Ingress annotations), but globally in the corresponding entry point definition (EntryPoints | Traefik | v2.2). The tls option should only be set in one entry point, so that this is probably not possible via the annotations, at least not currently. But the global configuration works great here, for example, with a similar setup and a https redirect.