# Multiple SSL certificate matching failed

**URL:** <https://community.traefik.io/t/multiple-ssl-certificate-matching-failed/3994>\
**Category:** Traefik v2\
**Tags:** tracing\
**Created:** [January 19, 2020, 10:15am UTC](https://community.traefik.io/t/multiple-ssl-certificate-matching-failed/3994 "2020-01-19T10:15:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![xxlaila](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/xxlaila/32/1471_2.png) [@xxlaila](https://community.traefik.io/u/xxlaila)\
**Post date:** [January 19, 2020, 10:15am UTC](https://community.traefik.io/t/multiple-ssl-certificate-matching-failed/3994/1 "2020-01-19T10:15:58Z")

</div>

The https certificate is purchased by the company. The first-level domain name is [a.com](http://a.com). The company is divided into three environments: dev, test, and prod, corresponding to three domain name certificates, [dev.a.com](http://dev.a.com), [test.a.com](http://test.a.com), and [a.com](http://a.com).  
When I use the domain name [xxx.a.com](http://xxx.a.com), I can load the [a.com](http://a.com) certificate.  
When I am using [xxx.dev.a.com](http://xxx.dev.a.com) or [xxx.test.a.com](http://xxx.test.a.com), I cannot load the corresponding [dev.a.com](http://dev.a.com) or [test.a.com](http://test.a.com) domain certificate

`ssl.toml` file

```auto
[tls]

  [[tls.certificates]]
    certFile = "/config/certs/a.com.crt"
    keyFile = "/config/certs/a.com.key"
    stores = ["default"]

  [[tls.crtificates]]
    crtFile = "/config/certs/dev.a.com.crt"
    keyFile = "/config/certs/dev.a.com.key"
    stores = ["adev"]

  [tls.options]
    [tls.options.default]
      minVersion = "VersionTLS12"
    [tls.options.mintls13]
      minVersion = "VersionTLS13"

```

`http.toml` file

```auto
[http]
  [http.routers]
    [http.routers.Router0001]
      namespace = "default"
      entryPoints = ["web", "websecure"]
      service = "appv2-a"
      rule = "Host (` ll.a.com`) "
      middlewares = ["test-ipwhitelist", "test-redirectscheme"]
      priority = 42
      [http.routers.Router0001.tls]

  [http.services]
    [http.services.appv2-a]
      [http.services.appv2-a.loadBalancer]
      passHostHeader = true
      [[http.services.appv2-a.loadBalancer.servers]]
        url = "http: //appv2.default.svc.cluster.local: 80"

```

The above configuration can load [a.com](http://a.com) certificate. If you write [ll.a.com](http://ll.a.com) as [ll.dev.a.com](http://ll.dev.a.com), you cannot load the [dev.a.com](http://dev.a.com) certificate.

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [January 19, 2020, 10:58am UTC](https://community.traefik.io/t/multiple-ssl-certificate-matching-failed/3994/2 "2020-01-19T10:58:18Z")

</div>

Hello,

The HTTPS redirection cannot be done like that, you have to create 2 routers.

```auto
[http.routers]
  [http.routers.Router0001]
    entryPoints = ["websecure"]
    service = "appv2-a"
    rule = "Host(`ll.a.com`)"
    middlewares = ["test-ipwhitelist"]
    priority = 42
    [http.routers.Router0001.tls]

[http.routers.Router0001-http]
  entryPoints = ["web"]
  service = "noop"
  rule = "Host(`ll.a.com`)"
  middlewares = ["test-redirectscheme"]

[http.services]
  [http.services.appv2-a]
    [http.services.appv2-a.loadBalancer]
      passHostHeader = true
      [[http.services.appv2-a.loadBalancer.servers]]
        url = "http: //appv2.default.svc.cluster.local: 80"
  
  [http.services.noop]
    [[http.services.noop.loadBalancer.servers]]
      url = "http://192.198.0.1:1337"

```

Recommend read:

- [Global http to https redirect in v2](https://community.containo.us/t/global-http-to-https-redirect-in-v2/1658/3)
- [https://blog.containo.us/traefik-2-0-docker-101-fc2893944b9d](https://blog.containo.us/traefik-2-0-docker-101-fc2893944b9d)
- [https://github.com/containous/blog-posts/tree/master/2019\_09\_10-101\_docker](https://github.com/containous/blog-posts/tree/master/2019_09_10-101_docker)
- [https://docs.traefik.io/v2.1/migration/v1-to-v2/#http-to-https-redirection-is-now-configured-on-routers](https://docs.traefik.io/v2.1/migration/v1-to-v2/#http-to-https-redirection-is-now-configured-on-routers)