<p>To redirect any HTTP traffic to HTTPS on tls enabled hosts, I have added the below annotation to my ingress resources</p>
<pre><code>nignx.ingress.kubernetes.io/force-ssl-redirect: true
</code></pre>
<p>With this when I curl the host in question, I get redirected as expected</p>
<p><a href="https://i.stack.imgur.com/bVR9N.png" rel="noreferrer"><img src="https://i.stack.imgur.com/bVR9N.png" alt="enter image description here" /></a></p>
<p>But when I use a browser, the request to HTTP times out.</p>
<p>Now, I am not sure if it's something I am doing wrong at Nginx ingress conf as curl works?
Any pointers please? Thanks!</p>
<p>complete annotaiotns:</p>
<pre><code>   annotations:
    kubernetes.io/ingress.class: nginx-ingress
    nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
    nginx.ingress.kubernetes.io/proxy-connect-timeout: &quot;300&quot;
    nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;300&quot;
    nginx.ingress.kubernetes.io/proxy-send-timeout: &quot;300&quot;
    nginx.ingress.kubernetes.io/ssl-passthrough: &quot;false&quot;
    nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;
</code></pre>
<p>rules</p>
<pre><code> rules:
  - host: hostX
    http:
      paths:
      - backend:
          serviceName: svcX
          servicePort: 8080
        path: /
  - host: hostY
    http:
      paths:
      - backend:
          serviceName: svcX
          servicePort: 8080
        path: /
  tls:
  - hosts:
    - hostX
  - hosts:
    - hostY
    secretName: hostY-secret-tls
</code></pre>
<p>Note:</p>
<ol>
<li>The curl mentioned is to hostY in the rule above.</li>
<li>HTTPS to hostY via browser works and so cert is valid one.</li>
</ol>

pa1
<p>As @mdaniel have mentioned your snippet shows <code>nignx.ingress.kubernetes.io/force-ssl-redirect: true</code> but annotations should be strings. Notice that in your &quot;complete&quot; config, you have both <code>force-ssl-redirect: &quot;true&quot;</code>  <em>(now correctly a string)</em> and <code>ssl-redirect: &quot;false&quot;</code> .</p>
<p>Simply remove annotation  <code>nginx.ingress.kubernetes.io/ssl-redirect: &quot;false&quot;</code> and leave just <code>nignx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;</code>
Also enable <a href="https://kubernetes.github.io/ingress-nginx/user-guide/cli-arguments/" rel="noreferrer"><code>--enable-ssl-passthrough</code></a>. This is required to enable passthrough backends in Ingress objects.</p>
<p>Your annotation should look like:</p>
<pre><code>kubernetes.io/ingress.class: nginx-ingress
nginx.ingress.kubernetes.io/force-ssl-redirect: &quot;true&quot;
nginx.ingress.kubernetes.io/ssl-passthrough: &quot;true&quot;
nginx.ingress.kubernetes.io/proxy-body-size: 100m
nginx.ingress.kubernetes.io/proxy-connect-timeout: &quot;300&quot;
nginx.ingress.kubernetes.io/proxy-read-timeout: &quot;300&quot;
nginx.ingress.kubernetes.io/proxy-send-timeout: &quot;300&quot;
</code></pre>
<p>If you defined hosts under TLS section they are going to be accessible only using https. HTTP requests are being redirected to use HTTPS. That is why you cannot access host via HTTP. Also you have to specify secret for host <code>hostX</code>, otherwise the default certificate will be used for ingress. Or if you don't want to connect to host <code>hostX</code> via HTTPS simply create different ingress without TLS section for it.</p>
<p>Take a look: <a href="https://kubernetes.github.io/ingress-nginx/user-guide/tls/" rel="noreferrer"></a>.</p>
