Redirect from non-www to www not working

Traefik Traefik v3 (latest)
,
1

Hi,

I am using traefik 3.3.1.
I am trying to redirect all traffic from non-www to www subdomain.
Here is the snippet from docker-compose:

labels:
  - traefik.enable=true
  - traefik.http.routers.myapp.entrypoints=http
  - traefik.http.routers.myapp.rule=Host(`mydomain.org`) || Host(`www.mydomain.org`)
  - traefik.http.routers.myapp.middlewares=https-redirectscheme@file, non-www-to-www@file
  - traefik.http.routers.myapp-secure.entrypoints=https
  - traefik.http.routers.myapp-secure.middlewares=non-www-to-www@file
  - traefik.http.routers.myapp-secure.rule=Host(`mydomain.org`) || Host(`www.mydomain.org`)
  - traefik.http.routers.myapp-secure.tls=true
  - traefik.http.routers.myapp-secure.service=myapp
  - traefik.http.services.myapp.loadbalancer.server.port=80

Here is the snippet from config.yml:

middlewares:
	non-www-to-www:
	  redirectregex:
		regex: "^https?://(?:www\\.)?(.+)"
		replacement: "https://www.${1}"
		permanent: true

And here is the snippet from traefik.yml:

certificatesResolvers:      
  wildcard:
    acme:
      email: mail@mydomain.org
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

The http->https redirect works as expected, but redirecting https://mydomain.org -> https://www.mydomain.org does not.
Firefox keeps the non-www version and issues a certificate warning.
Is there something wrong with the config?

When trying with https://mydomain.org, here is the traefik log:

2025-01-09T10:52:57+01:00 DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "cloudflare-ech.com"
2025-01-09T10:52:57+01:00 DBG log/log.go:245 > http: TLS handshake error from 192.168.1.110:55317: remote error: tls: bad certificate
2025-01-09T10:52:57+01:00 DBG github.com/traefik/traefik/v3/pkg/tls/tlsmanager.go:228 > Serving default certificate for request: "cloudflare-ech.com"
2025-01-09T10:52:57+01:00 DBG log/log.go:245 > http: TLS handshake error from 192.168.1.110:55318: remote error: tls: bad certificate

To me this reads as traefik not having a cert for mydomain.org, but only for the working www.mydomain.org. So it seems redirect to www is not working.

2

I solved it!
The primary cert for mydomain.org was missing, since the domains configuration was wrong. Instead of only
- traefik.http.routers.whoami-secure.tls.domains[0].main=*mydomain.org
it must be

- traefik.http.routers.whoami-secure.tls.domains[0].main=mydomain.org
- traefik.http.routers.whoami-secure.tls.domains[0].sans=*.mydomain.org
3

You enabled TLS in the secure router, but did not assign the certResolver. I recommend to assign TLS globally on entrypoint, reduces config lines.

Compare to simple Traefik example.