# Again redirect http 80 to https 443

**URL:** <https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604>\
**Category:** Help!\
**Created:** [August 13, 2020, 9:17pm UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604 "2020-08-13T21:17:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![f1outsourcing](https://avatars.discourse-cdn.com/v4/letter/f/a183cd/32.png) [@f1outsourcing](https://discourse.haproxy.org/u/f1outsourcing)\
**Post date:** [August 13, 2020, 9:17pm UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604/1 "2020-08-13T21:17:02Z")

</div>

I am using haproxy 2.2 and tried several redirects also the below with http-request as mentioned here[1] and splitting this into 2 different frontends.

Currently I am having configured as from:

```
frontend https
  bind 0.0.0.0:80
  redirect scheme https code 301 if !{ ssl_fc }
  bind 0.0.0.0:"$PORT2"

```

Logs are showing this

```
https https/<NOSRV> -1/-1/1 0 SC 4/2/0/0/0 0/0
https https/<NOSRV> -1/-1/0 0 SC 4/2/0/0/0 0/0
https https/<NOSRV> -1/-1/0 0 SC 4/2/0/0/0 0/0
https https/<NOSRV> -1/-1/0 0 SC 13/11/0/0/0 0/0
https https/<NOSRV> -1/-1/0 0 SC 9/7/0/0/0 0/0
https https/<NOSRV> -1/-1/0 0 SC 4/2/0/0/0 0/0
https https/<NOSRV> -1/-1/0 0 SC 4/2/0/0/0 0/0

```

If I just type [test.example.com](http://test.example.com) in the browser, I do not seem to end up at [https://test.example.com](https://test.example.com)

If I just type [https://test.example.com](https://test.example.com) in the browser, I am getting a the correct page. ( actually redirected to [https://test.example.com/path/path/](https://test.example.com/path/path/)

[1]

> [@301 redirect over https doesn't include HSTS header (HAProxy 2.1)](https://discourse.haproxy.org/t/301-redirect-over-https-doesnt-include-hsts-header-haproxy-2-1/4999/5):
>
> All the redirects need to happen in a second proxy layer (in this case, the frontend redirects listening on 127.0.0.1:8081 - so make sure that port is free or use a different one). This also requires another backend, which is needsredirect here that is needed to divert the traffic to the new frontend. The original frontend http-in must not contain any redirect rules (just the HSTS settings) and must make sure that request that still need to be redirected go through backend needsredirect to fron…

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 14, 2020, 9:43am UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604/2 "2020-08-14T09:43:04Z")

</div>

Please post the entire configuration, and the output of a `curl -vv` call.

---

<div class="post-metadata">

**Author:** ![f1outsourcing](https://avatars.discourse-cdn.com/v4/letter/f/a183cd/32.png) [@f1outsourcing](https://discourse.haproxy.org/u/f1outsourcing)\
**Post date:** [August 16, 2020, 2:29pm UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604/3 "2020-08-16T14:29:24Z")

</div>

This is part of config 🙄, I do not have any other fronted with a port 80 bind. I assume it is related to redirecting based on sni.

```
frontend https
  bind 0.0.0.0:80
  redirect scheme https code 301 if !{ ssl_fc }

  bind 0.0.0.0:"$PORT2"
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend _recir_webchat if { req_ssl_sni -i webchat.example.com }
  use_backend _recir_synapse if { req_ssl_sni -i riot.example.com }
  ...

backend _recir_webchat
  server loopback-for-tls abns@webchat send-proxy-v2
backend _recir_synapse
  server loopback-for-tls abns@synapse send-proxy-v2
backend _recir_test
...

frontend webchat
  #bind 0.0.0.0:8080
  #bind 0.0.0.0:443 ssl crt webchat.example.com.pem
  bind abns@webchat accept-proxy ssl crt webchat.example.com.pem
  mode http
  ...
  

frontend synapse
  #bind 0.0.0.0:8080
  #bind 0.0.0.0:443 ssl crt element.example.com.pem
  bind abns@synapse accept-proxy ssl crt riot.example.com.pem
  mode http
  ...

```

This is just accessing the ip on http

```
* About to connect() to x.x.x.x port 80 (#0)
* Trying x.x.x.x... connected
* Connected to x.x.x.x (x.x.x.x) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.44 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: x.x.x.x
> Accept: */*
>
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Empty reply from server
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connection #0 to host x.x.x.x left intact

curl: (52) Empty reply from server
* Closing connection #0

```

This is accessing a domain with http

```
* About to connect() to test.example.com port 80 (#0)
* Trying x.x.x.x... connected
* Connected to test.example.com (x.x.x.x) port 80 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.44 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
> Host: test.example.com
> Accept: */*
>
  % Total % Received % Xferd Average Speed Time Time Time Current
                                 Dload Upload Total Spent Left Speed
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Empty reply from server
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Connection #0 to host test.example.com left intact

curl: (52) Empty reply from server
* Closing connection #0
```

---

<div class="post-metadata">

**Author:** ![f1outsourcing](https://avatars.discourse-cdn.com/v4/letter/f/a183cd/32.png) [@f1outsourcing](https://discourse.haproxy.org/u/f1outsourcing)\
**Post date:** [August 16, 2020, 2:50pm UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604/4 "2020-08-16T14:50:03Z")

</div>

I was just testing with apache ab, and got on the https url this

SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).  
SSL handshake failed (5).

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [August 16, 2020, 7:07pm UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604/5 "2020-08-16T19:07:17Z")

</div>

If you want to redirect you need a frontend in `mode http`.

You also have SNI routing there in the same frontend (which needs `mode tcp`). Assuming you get SSL traffic on `$PORT2` (and that’s what the SNI routing is for) you need to divide the two:

```
frontend http
  mode http
  bind 0.0.0.0:80
  redirect scheme https code 301 if !{ ssl_fc }

frontend https
  mode tcp
  bind 0.0.0.0:"$PORT2"
  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }
  use_backend _recir_webchat if { req_ssl_sni -i webchat.example.com }
  use_backend _recir_synapse if { req_ssl_sni -i riot.example.com }

```

You did not share your default section, so I just explicitly declared `mode http` and `mode tcp` respectively.

---

<div class="post-metadata">

**Author:** ![f1outsourcing](https://avatars.discourse-cdn.com/v4/letter/f/a183cd/32.png) [@f1outsourcing](https://discourse.haproxy.org/u/f1outsourcing)\
**Post date:** [August 16, 2020, 8:33pm UTC](https://discourse.haproxy.org/t/again-redirect-http-80-to-https-443/5604/6 "2020-08-16T20:33:24Z")

</div>

Yes that solved it indeed! Thanks