# HTTPS external traffic to request HTTP internal traffic **URL:** \ **Category:** Traefik v2\ **Tags:** docker\ **Created:** [April 9, 2023, 5:34am UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198 "2023-04-09T05:34:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nitobuendia](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/nitobuendia/32/6945_2.png) [@nitobuendia](https://community.traefik.io/u/nitobuendia)\ **Post date:** [April 9, 2023, 5:34am UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/1 "2023-04-09T05:34:18Z")
Hi all, this is probably a very basic question, but I couldn't find a clear answer after I've tried a few things. ## Context I am basically trying to migrate from nginx to traefik as my reverse proxy. I've set up the first service and it works well, when I access the `http` scheme. However, when I access with `https`, traefik returns `404 page not found`. For what I've read this might be because traefik is sending `https` traffic to the `https` scheme on the docker container, but this service only supports http. ## Questions - How can I indicate traefik https (websecure) to request the docker container on the http scheme while using its own certificates? ## Set up traefik/docker-compose.yaml ```yaml version: '3' services: reverse-proxy: container_name: traefik image: traefik:latest restart: unless-stopped environment: - TZ=Asia/Singapore network_mode: host volumes: - /var/run/docker.sock:/var/run/docker.sock - ./data/traefik.yml:/etc/traefik/traefik.yml - ./ssl:/ssl - ./logs:/logs ``` _(note: /ssl contains my certificates that I generate externally)_ /traefik/data/traefik.yml ```yaml accessLog: filePath: "/logs/access.log" api: dashboard: true insecure: true entryPoints: traefik: address: ":9880" web: address: ":998" websecure: address: ":999" global: sendAnonymousUsage: false http: serversTransport: insecureSkipVerify: false log: filePath: "/logs/traefik.log" providers: docker: exposedByDefault: false useBindPortIp: true tls: certificates: - certFile: /ssl/fullchain.pem keyFile: /ssl/privkey.pem ``` Sample service: bazarr/docker-compose.yaml ```yaml version: "2.1" services: bazarr: image: lscr.io/linuxserver/bazarr container_name: bazarr restart: unless-stopped ports: - 9867:6767 environment: - TZ=Asia/Singapore - PUID=1000 - PGID=1000 volumes: - ./config:/config labels: - "traefik.enable=true" - "traefik.http.routers.bazarr-internal.rule=Host(`bazarr.mydomain.com`)" ``` ## Issue Accessing `http://bazarr.mydomain.com:998` works fine. Accessing `https://bazarr.mydomain.com:999` throws 404. bazarr does not have SSL configured, I want to leverage traefik to do this. The certificates also didn't seem to load properly, so maybe it could be related. ## Additional Context (nginx config) For context, this is how my nginx config looks like for this service (i.e. what I am trying to replicate): ```conf server { server_name bazarr.mydomain.com; listen 80 ssl http2; listen [::]:80 ssl http2; listen 443 ssl http2; listen [::]:443 ssl http2; ssl_certificate /etc/ssl/private/fullchain.pem; ssl_certificate_key /etc/ssl/private/privkey.pem; location / { proxy_pass http://bazarr.mydomain.com:9867; proxy_ssl_server_name on; proxy_http_version 1.1; proxy_cache_bypass $http_upgrade; proxy_set_header Host $host:$server_port; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Host $http_host; proxy_set_header X-Forwarded-Port $server_port; proxy_set_header Origin ''; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_headers_hash_max_size 512; proxy_headers_hash_bucket_size 128; proxy_connect_timeout 60s; proxy_send_timeout 60s; proxy_read_timeout 60s; } } ``` ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [April 9, 2023, 2:31pm UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/2 "2023-04-09T14:31:31Z")
Configure your custom TLS certs in a dynamic config file ([docs](https://doc.traefik.io/traefik/https/tls/#user-defined)), load using `provider.file` in static config `traefik.yml`. Enable basic TLS on entrypoint ([docs](https://doc.traefik.io/traefik/routing/entrypoints/#tls)) or on router ([docs](https://doc.traefik.io/traefik/routing/routers/#tls)), just set it to `true` (command/label) or `{}` (yml). Then Traefik will by default "terminate TLS" and forward requests in plain http to the service. ---
**Author:** ![nitobuendia](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/nitobuendia/32/6945_2.png) [@nitobuendia](https://community.traefik.io/u/nitobuendia)\ **Post date:** [April 17, 2023, 3:47pm UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/3 "2023-04-17T15:47:09Z")
Thanks @bluepuma77 - your pointers were quite helpful. Adding `http: tls: {}` to the `entryPoints` config did the trick to get the https call the service http endpoint. However, the certificate loaded is still traefik's default one instead of the one I am specifying. This is likely because the first point is still missing, but I am trying to take a slightly different route. I was thinking of just using [default certificates](https://doc.traefik.io/traefik/https/tls/#default-certificate) for the whole domain. However, I can't make it work. When I add: ```yaml entryPoints: https: address: ":999" http: tls: {} ``` I can see the services using `https` entryPoint using tls with options default. However, I haven't managed to assign the certificates file to it. My tries have been: ```yaml tls: stores: default: defaultCertificate: certFile: /ssl/fullchain.pem keyFile: /ssl/privkey.pem ``` ```yaml tls: certificates: - certFile: /ssl/fullchain.pem keyFile: /ssl/privkey.pem ``` Note: I am certain the files exist on `/ssl/` and I have seen this post confirming I need fullchain.pem. All code above is on my `/etc/traefik/traefik.yml` file. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [April 17, 2023, 8:26pm UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/4 "2023-04-17T20:26:44Z")
As stated before, `tls.certificates` can not be in static config `traefik.yml`, which contains `entrypoints` and `providers`. It needs to be dynamic config, loaded from a separate file. ---
**Author:** ![nitobuendia](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/nitobuendia/32/6945_2.png) [@nitobuendia](https://community.traefik.io/u/nitobuendia)\ **Post date:** [April 18, 2023, 10:39am UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/5 "2023-04-18T10:39:45Z")
Thank you! I went back to read about [static vs dynamic config](https://doc.traefik.io/traefik/getting-started/configuration-overview/#:~:text=Elements%20in%20the%20static%20configuration,are%20handled%20by%20your%20system.) and I was able to fix it. Thanks again for the pointer. For anyone reading this in the future and looking for the fix. The [suggestions here](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/2) are what you need to follow. There are multiple ways to approach those instructions. This is how I solved it: 1. Create one config for static and another file for dynamic configuration and add them to `docker-compose.yaml` ```yaml volumes: - /var/run/docker.sock:/var/run/docker.sock - ./data/traefik.yml:/etc/traefik/traefik.yml # Static configuration. - ./data/config:/etc/traefik/config # Dynamic configuration. - ./ssl:/ssl - ./logs:/logs ``` 1. On the static config (`/etc/traefik/traefik.yaml`) under `entryPoints` on `https`, add the tls option: ```yaml entryPoints: https: address: ":999" http: tls: {} ``` 1. On the static config, under `providers` add an additional provider for loading the dynamic config files. In my case, I decided to place this under `"/etc/traefik/config"` but you can select a different path. ```yaml providers: file: directory: "/etc/traefik/config" watch: true ``` 1. On the dynamic config file (any YAML file under "/etc/traefik/config"), add the TLS configuration: ```yaml tls: certificates: - certFile: /ssl/fullchain.pem keyFile: /ssl/privkey.pem ``` 1. On the docker service (docker-compose.yaml), which is the provider I use for my services, I am using the following labels: ```yaml labels: - "traefik.enable=true" - "traefik.http.routers.service-name.rule=Host(`subdomain.domain.com`)" - "traefik.http.routers.service-name.entrypoints=https" ``` If I understand correctly, this adds the service to the entryPoints `https` which has https enabled with the default tls and the default tls has been configured on the dynamic config to the /ssl/fullchain.pem and /ssl/privkey.pem which is what you may have obtained from your own certificate provider. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\ **Post date:** [April 21, 2023, 10:40am UTC](https://community.traefik.io/t/https-external-traffic-to-request-http-internal-traffic/18198/6 "2023-04-21T10:40:19Z")
This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.