Question: I keep telling myself this should be simple. Background: I had a site set up (<https://example.com>) using Let's Encrypt for the SSL setup. Works great. I added a new server to the internal network with another site, NO SSL setup at all. Works great. Time to add it as a subdomain (<http://sub1.example.com>) I thought a simple reverse proxy in Apache would do the trick. BUT... when I go to <http://sub1.example.com> I get redirected to <https://sub1.example.com>... Which doesn't work for obvious reasons.

default.conf - 

```
<VirtualHost *:80>
ServerName example.com       
DocumentRoot /var/www/html

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

RewriteEngine on
RewriteCond %{SERVER_NAME} =example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

```

(I'm pretty sure it is the rewrite rule interfering, but not sure how to fix it?)

Sub1.conf:

```
<VirtualHost *:80>
ServerName sub1.example.com
<Proxy *>
    Order deny,allow
    Allow from all
</Proxy>

<Location />
    ProxyPass http://10.10.10.145/
    ProxyPassReverse http://10.10.10.145/
</Location>

</VirtualHost>

```

So... What am I missing? (I can include the default-ssl.conf file as well if it may be helpful, just say so!)

Thanks!

Answer: 
There is nothing in the configuration that you posted that would trigger the redirect.

A cause might be found outside of your Apache config in either the configuration of your ProxyPass target URL `http://10.10.10.145/` or it could be be that you have [**HSTS**](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) configured on your main domain example.com with an **`includeSubDomains`** policy.  

That will apply the policy of example.com to sub1.example.com and "correct" *"incorrect URL's"* directly in your browser and change them from http to httpS.

Test from an incognito window or a simple command-line `curl -v sub1.example.com`
HBruijn had it right. I looked in the additional .conf file Let's Encrypt loads (/etc/letsencrypt/options-ssl-apache.conf) and sure enough HSTS with "includeSubDomains" was in there

I knew I was missing something simple. Thank you guys!