@razr Thanks for the suggestion. After reading your comment I tried to search similar issue and found this which pointed me here
If you need to define the same route for both HTTP and HTTPS requests, you will need to define two different routers: one with the tls section, one without.
I had completely missed this in my traefik setup. After splitting IngressRoute into two Firefox/curl was able to load the page with https redirect.
app-external
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: app-external
namespace: qa
spec:
entryPoints:
- web
routes:
- match: Host(`qa.domain.com`)
kind: Rule
services:
- name: nginx
port: 80
middlewares:
- name: secured-restricted
app-external-secure
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: app-external-secure
namespace: qa
spec:
entryPoints:
- websecure
routes:
- match: Host(`qa.domain.com`)
kind: Rule
services:
- name: nginx
port: 80
middlewares:
- name: secured-restricted
tls:
secretName: qa-cert
But python request
lib still fails with same error as mentioned in my main question.