diff --git a/config/haproxy/haproxy.cfg b/config/haproxy/haproxy.cfg
index 37582db..3a78f45 100644
--- a/config/haproxy/haproxy.cfg
+++ b/config/haproxy/haproxy.cfg
@@ -41,6 +41,7 @@ frontend web
     bind :443 ssl crt /certificates strict-sni
 
     http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }
+    http-request redirect scheme https code 301 unless { ssl_fc }
 
     http-request set-header X-Forwarded-Protocol https
     http-request set-header X-Forwarded-Proto https