# Redirection to wrong port/certificate

**URL:** <https://community.traefik.io/t/redirection-to-wrong-port-certificate/8187>\
**Category:** Traefik v2\
**Tags:** docker, middleware\
**Created:** [October 14, 2020, 10:16pm UTC](https://community.traefik.io/t/redirection-to-wrong-port-certificate/8187 "2020-10-14T22:16:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![typedef](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@typedef](https://community.traefik.io/u/typedef)\
**Post date:** [October 14, 2020, 10:16pm UTC](https://community.traefik.io/t/redirection-to-wrong-port-certificate/8187/1 "2020-10-14T22:16:14Z")

</div>

Hello community! I'm trying to configure a weird setup. Server hosts an Apache server that listens on 80 and 443 (_random.domain_). Traefik listens on 65000 (HTTP) and 65001 (HTTPS) for a different domain (_subdomain.random.domain_ and _some.random.domain_). Traefik dashboard listens on localhost:65002.

The issue I have is that when I make a request for _[http://subdomain.random.domain:65000](http://subdomain.random.domain:65000)_ or _[http://some.random.domain:65000](http://some.random.domain:65000)_ redirection to HTTPS indeed takes place, however I'm presented with the certificate that Apache serves for _[https://random.domain](https://random.domain)_. I'm not sure why this happens but it looks like Traefik when redirecting to HTTPS routes traffic to localhost:443 instead of Traefik's entrypoint (443).

Would appreciate if anyone could point me to the right direction.

This is my configuration:

traefik.toml

```auto
[entryPoints]
  [entryPoints.dashboard]
    address = ":9090"
  [entryPoints.web]
    address = ":80"
    [entryPoints.web.http]
      [entryPoints.web.http.redirections]
        [entryPoints.web.http.redirections.entryPoint]
          to = "websecure"
          scheme = "https"
  [entryPoints.websecure]
    address = ":443"

[api]
  dashboard = true

[providers]
  [providers.file]
    directory = "/dynconf"
    watch = true
  [providers.docker]
    endpoint = "unix:///var/run/docker.sock"
    network = "traefik_network"
    exposedByDefault = false

```

docker-compose.yml

```auto
version: '3.7'
services:
  # traefik service
  traefik:
    image: "traefik:v2.2"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.to-dashboard.rule=Host(`dashboard.local`)"
      - "traefik.http.routers.to-dashboard.entrypoints=dashboard"
      - "traefik.http.routers.to-dashboard.middlewares=auth"
      - "traefik.http.routers.to-dashboard.service=api@internal"
      - "traefik.http.middlewares.auth.basicauth.users=admin:<PASSWORD>"

    container_name: "traefik"
    ports:
      - "65000:80"
      - "65001:443"
      - "127.0.0.1:65002:9090"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/home/traefik/traefik.toml:/traefik.toml:ro"
      - "/home/traefik/letsencrypt/acme.json:/acme.json"
      - "/home/traefik/dynconf/dyn.toml:/dynconf/dyn.toml"
      - "/home/traefik/certs/:/certs/"

  httpecho:
    image: "hashicorp/http-echo"
    container_name: "httpecho"
    command: "-text='hello world!'"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.to-httpecho.rule=Host(`subdomain.random.domain`)"
      - "traefik.http.routers.to-httpecho.entrypoints=web"
      - "traefik.http.routers.to-httpecho.middlewares=https_redirect"

      - "traefik.http.routers.to-httpecho-secure.rule=Host(`subdomain.random.domain`)"
      - "traefik.http.routers.to-httpecho-secure.entrypoints=websecure"
      - "traefik.http.routers.to-httpecho-secure.tls=true"

      - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true"

  whoami:
    image: "traefik/whoami"
    container_name: "whoami"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.to-whoami.rule=Host(`some.random.domain`)"
      - "traefik.http.routers.to-whoami.entrypoints=web"
      - "traefik.http.routers.to-whoami.middlewares=https_redirect"

      - "traefik.http.routers.to-whoami-secure.rule=Host(`some.random.domain`)"
      - "traefik.http.routers.to-whoami-secure.entrypoints=websecure"
      - "traefik.http.routers.to-whoami-secure.tls=true"

      - "traefik.http.middlewares.https_redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.https_redirect.redirectscheme.permanent=true"

networks:
  default:
    external:
      name: "traefik_network"

```

---

<div class="post-metadata">

**Author:** ![ldez](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ldez/32/5_2.png) [@ldez](https://community.traefik.io/u/ldez)\
**Post date:** [October 15, 2020, 12:02am UTC](https://community.traefik.io/t/redirection-to-wrong-port-certificate/8187/2 "2020-10-15T00:02:23Z")

</div>

Hello,

Traefik creates the redirection base on the entry points, your entry points are on 80, 443, and 9090.  
Traefik is not aware of your port mappings.

You have to change the entry points ports to 65000 and 65001 and change your ports mappings.

You can also simplify your configuration:

```auto
version: '3.7'

services:

  traefik:
    image: traefik:v2.3.1
    container_name: traefik
    ports:
      - 65000:65000
      - 65001:65001
      - 127.0.0.1:65002:65002
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/traefik/letsencrypt/acme.json:/acme.json
      - /home/traefik/dynconf/dyn.toml:/dynconf/dyn.toml
      - /home/traefik/certs/:/certs/
    command:
      - --api

      - --entrypoints.dashboard.address=:65002

      - --entrypoints.web.address=:65000
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      
      - --entrypoints.websecure.address=:65001
      - --entrypoints.websecure.http.tls=true
      
      - --providers.docker.exposedByDefault=false
      - --providers.docker.network=traefik_network

      - --providers.file.directory=/dynconf
      - --providers.file.watch=true
    labels:
      traefik.enable: 'true'
      traefik.http.routers.to-dashboard.rule: Host(`dashboard.local`)
      traefik.http.routers.to-dashboard.entrypoints: dashboard
      traefik.http.routers.to-dashboard.middlewares: auth
      traefik.http.routers.to-dashboard.service: api@internal
      traefik.http.middlewares.auth.basicauth.users: admin:<PASSWORD>

  httpecho:
    image: hashicorp/http-echo
    container_name: httpecho
    command: "-text='hello world!'"
    labels:
      traefik.enable: 'true'
      traefik.http.routers.to-httpecho-secure.rule: Host(`subdomain.random.domain`)
      traefik.http.routers.to-httpecho-secure.entrypoints: web,websecure

  whoami:
    image: traefik/whoami
    container_name: whoami
    labels:
      traefik.enable: 'true'
      traefik.http.routers.to-whoami-secure.rule: Host(`some.random.domain`)
      traefik.http.routers.to-whoami-secure.entrypoints: web,websecure

networks:
  default:
    external:
      name: traefik_network

```

* * *

If you to keep your port mapping, your have to change the flag `--entrypoints.web.http.redirections.entrypoint.to=websecure` to `--entrypoints.web.http.redirections.entrypoint.to=:65001`

```auto
version: '3.7'

services:

  traefik:
    image: traefik:v2.3.1
    container_name: traefik
    ports:
      - 65000:80
      - 65001:443
      - 127.0.0.1:65002:8080
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/traefik/letsencrypt/acme.json:/acme.json
      - /home/traefik/dynconf/dyn.toml:/dynconf/dyn.toml
      - /home/traefik/certs/:/certs/
    command:
      - --api

      - --entrypoints.dashboard.address=:8080

      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entrypoint.to=:65001
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      
      - --entrypoints.websecure.address=:443
      - --entrypoints.websecure.http.tls=true
      
      - --providers.docker.exposedByDefault=false
      - --providers.docker.network=traefik_network

      - --providers.file.directory=/dynconf
      - --providers.file.watch=true
    labels:
      traefik.enable: 'true'
      traefik.http.routers.to-dashboard.rule: Host(`dashboard.local`)
      traefik.http.routers.to-dashboard.entrypoints: dashboard
      traefik.http.routers.to-dashboard.middlewares: auth
      traefik.http.routers.to-dashboard.service: api@internal
      traefik.http.middlewares.auth.basicauth.users: admin:<PASSWORD>

  httpecho:
    image: hashicorp/http-echo
    container_name: httpecho
    command: "-text='hello world!'"
    labels:
      traefik.enable: 'true'
      traefik.http.routers.to-httpecho-secure.rule: Host(`subdomain.random.domain`)
      traefik.http.routers.to-httpecho-secure.entrypoints: web,websecure

  whoami:
    image: traefik/whoami
    container_name: whoami
    labels:
      traefik.enable: 'true'
      traefik.http.routers.to-whoami-secure.rule: Host(`some.random.domain`)
      traefik.http.routers.to-whoami-secure.entrypoints: web,websecure

networks:
  default:
    external:
      name: traefik_network

```

---

<div class="post-metadata">

**Author:** ![typedef](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@typedef](https://community.traefik.io/u/typedef)\
**Post date:** [October 15, 2020, 8:16pm UTC](https://community.traefik.io/t/redirection-to-wrong-port-certificate/8187/3 "2020-10-15T20:16:20Z")

</div>

Thank you so much for all this information!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [October 18, 2020, 8:16pm UTC](https://community.traefik.io/t/redirection-to-wrong-port-certificate/8187/4 "2020-10-18T20:16:24Z")

</div>

Closed on October 18, 2020, 8:16pm UTC

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.