<p>I am using Traefik (v2.2) on Kubernetes, using a wildcard domain certificate for HTTPS access.</p>
<p>The following are my Traefik deployment and Ingress configurations:</p>
<pre><code>kind: Deployment
apiVersion: apps/v1
metadata:
  namespace: ingress-traefik
  name: traefik
  labels:
    app: traefik

spec:
  replicas: 1
  selector:
    matchLabels:
      app: traefik
  template:
    metadata:
      labels:
        app: traefik
    spec:
      serviceAccountName: traefik-ingress-controller
      containers:
        - name: traefik
          image: traefik:v2.2
          ports:
            - name: web
              containerPort: 80
            - name: websecure
              containerPort: 443
            - name: admin
              containerPort: 8080
          args:
            - --providers.kubernetesingress
            - --entrypoints.web.Address=:80
            - --entrypoints.websecure.Address=:443
            - --ping.entryPoint=web

---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: traefik-ingress
  annotations:
    kubernetes.io/ingress.class: traefik
    traefik.ingress.kubernetes.io/router.entrypoints: web, websecure

    # remark the following line, HTTPS will return &quot;404 page not found&quot;
    # enable the following line, HTTP will return &quot;404 page not found&quot;
    traefik.ingress.kubernetes.io/router.tls: &quot;true&quot;

    cert-manager.io/cluster-issuer: letsencrypt-prod

spec:
  tls:
    - secretName: cert-stage-wildcard

  rules:
    - host: user.example.io
      http:
        paths:
        - path: /
          backend:
            serviceName: user-service
            servicePort: http
</code></pre>
<p>I want to have both HTTP and HTTPS working, but seems cannot do both:</p>
<p>If I comment the annotation 'traefik.ingress.kubernetes.io/router.tls: &quot;true&quot;' of the ingress, HTTP will work but HTTPS will not:</p>
<pre><code>$ curl -v https://user.example.io
*   Trying 159.203.52.215:443...
* TCP_NODELAY set
* Connected to user.example.io (159.203.52.215) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /home/ken.tsoi/anaconda3/ssl/cacert.pem
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: CN=*.example.io
*  start date: Oct 28 16:10:10 2020 GMT
*  expire date: Jan 26 16:10:10 2021 GMT
*  subjectAltName: host &quot;user.example.io&quot; matched cert's &quot;*.example.io&quot;
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
&gt; GET / HTTP/1.1
&gt; Host: user.example.io
&gt; User-Agent: curl/7.68.0
&gt; Accept: */*
&gt; 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Mark bundle as not supporting multiuse
&lt; HTTP/1.1 404 Not Found
&lt; Content-Type: text/plain; charset=utf-8
&lt; X-Content-Type-Options: nosniff
&lt; Date: Wed, 28 Oct 2020 21:45:38 GMT
&lt; Content-Length: 19
&lt; 
404 page not found
* Connection #0 to host user.example.io left intact
</code></pre>
<p>If I enable the annotation line, HTTP will return &quot;404 page not found&quot;:</p>
<pre><code>$ curl -v http://user.example.io
*   Trying 159.203.52.215:80...
* TCP_NODELAY set
* Connected to user.example.io (159.203.52.215) port 80 (#0)
&gt; GET / HTTP/1.1
&gt; Host: user.example.io
&gt; User-Agent: curl/7.68.0
&gt; Accept: */*
&gt; 
* Mark bundle as not supporting multiuse
&lt; HTTP/1.1 404 Not Found
&lt; Content-Type: text/plain; charset=utf-8
&lt; X-Content-Type-Options: nosniff
&lt; Date: Wed, 28 Oct 2020 21:49:07 GMT
&lt; Content-Length: 19
&lt; 
404 page not found
* Connection #0 to host user.example.io left intact
</code></pre>
<p>I guess there should be some small error with the setting, can anyone find out where the problem is ?</p>

Ken Tsoi
<p>From the document of <a href="https://doc.traefik.io/traefik/v2.2/routing/routers/#tls" rel="noreferrer">traefik/v2.2/routing/routers/tls</a>, it says that &quot; When a TLS section is specified, it instructs Traefik that the current router is dedicated to HTTPS requests only (and that the router should ignore HTTP (non TLS) requests). &quot;.</p>
<p>That explains all what I have encountered.</p>
<p>My solution to this was to create two ingress routers, one for HTTP and another for HTTPS.</p>
