Problem with www to non-www redirect because of HSTS

Traefik Traefik v2 (latest)
1

I'm trying to redirect https://www.domain.com to https://domain.com but I have an issue. When I curl https://www.domain.com , I get a HSTS error and i'm not redirected. Basically my browser (curl) wants to approve the SSL certificate first I think, and it's failing, that's why chrome shows an HSTS issue.

This is my router, i tried removing the tls: option too

    www-to-nonwww:
      entryPoints:
        - https
      rule: "HostRegexp(`{host:(www\\.).+}`)"
      service: noop@internal
      tls:
        certResolver: le
      middlewares:
        - https-nonwww

My certResolver works fine with the normal router (the one with rule: https://domain.com)

Any idea?

2

I'm sure that curl does not care for HSTS, it will be a certificate error because it will be using the self-signed traefik default certificate.

Chrome will show the HSTS error for the same reason. It is an HSTS error (vs a plain certificate error) because this site has presented an HSTS at some point in the past or it is an HSTS site compiled into the browser.

You have no definitive host in the rule for le to resolve a certificate to.

You can either make your rule a Host rule Host(`www.domain.com`)

Or add more tls options to your router:

      tls:
        certResolver: le
        domains:
          - main: "domain.com"
             sans: 
             - "www.domain.com"
3

yea, curl throws an error, chrome shows HSTS issue.

about your solution... my approach serves to redirect ALL websites, not just a single one, so... how i can make it not dependent on main: domain.com?

4

Sorry hopefully I did not conflate your issue. You could do it like this for multiple certificates for www. redirects:

      tls:
        certResolver: le
        domains:
          - main: "www.domain1.com"
             sans: 
             - "www.domain2.com"
             - "www.someplace.io"
             - "www.example.net"

Personally I would set the www and the bare domain on the router handling the domain. Or declare multiple in one route somewhere.

5

thanks! that helps :slight_smile: