Reverse proxy https to http backends fails

[creynders]

What version of Traefik are you using (traefik version)?

v1.1.2

What is your environment & configuration (arguments, toml...)?

Bare bones exemplary traefik.toml

InsecureSkipVerify = true
defaultEntryPoints = ["https"]
[entryPoints]
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
[frontends]
  [frontends.bladerunner]
  backend="deckard"
  passHostHeader = true
    [frontends.bladerunner.routes.deckard]
    rule = "Host:deckard.example.com"
[backends]
  [backend.deckard]
    [backends.deckard.servers.harrison]
    url = "http://harrison.example.com/"
[acme]
  email = "[email protected]"
  storage = "/etc/traefik/acme/acme.json"
  entryPoint = "https"
  OnHostRule = true
  [[acme.domains]]
    main="example.com"
    sans=["deckard.example.com"]

harrison.example.com is only accessible from the server running traefik (i.e. the one our A/AAAA records point deckard.example.com to)

What did you expect to see?

I'd expect to be able to connect to https://deckard.example.com, which would proxy pass the request to http://harrison.example.com while encrypting all communication to the client with automatic SSL

What did you see instead?

An error is thrown:

Error getting ACME certificate for domain [example.com deckard.example.com]: Cannot obtain certificates map[example.com:acme: Error 400 - urn:acme:error:malformed - Failed to connect to XXX.XXX.XXX.XXX:443 for TLS-SNI-01 challenge: Server only speaks HTTP, not TLS\nError Detail:\n\tValidation for example.com:443\n\tResolved to:\n\t\tXXX.XXX.XXX.XXX\n\tUsed: XXX.XXX.XXX.XXX\n\n]+v

Is this not possible, or am I missing something in my configuration?

[Berndinox]

i do use the following entrypoint and that does work:

[entryPoints]
 [entryPoints.http]
 address = ":80"
 compress = false
   [entryPoints.http.redirect]
      entryPoint = "https"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]

[errm]

Yes I think you need to have port 80 open too for ACME to work...

[creynders]

Thanks for the answers. Turns out that the A-record for harrison.example.com pointed to the correct server, but there was another one for example.com which pointed to yet another server, which was the culprit!