Home / Docs / Server certificate install guide (HAProxy)

Server certificate install guide (HAProxy)

From CSR to a combined PEM, frontend/backend config and backup.

Server certificate install guide (HAProxy)

HAProxy terminates TLS at the edge and needs the full chain and private key in a single PEM file.

1. Generate a private key and CSR

openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
openssl req -new -key server.key -out server.csr

Submit server.csr for issuance and back up server.key.

2. Prepare the PEM file

HAProxy expects the server certificate, intermediate and key in one PEM, in order:

cat server.crt chain.crt server.key > /etc/haproxy/certs/example.pem
chmod 600 /etc/haproxy/certs/example.pem

3. Configure frontend / backend

frontend https-in
    bind *:443 ssl crt /etc/haproxy/certs/example.pem
    mode http
    default_backend web-servers

backend web-servers
    mode http
    server web1 10.0.0.11:80 check
    server web2 10.0.0.12:80 check

4. Redirect HTTP to HTTPS

frontend http-in
    bind *:80
    mode http
    redirect scheme https code 301 if !{ ssl_fc }

5. Validate and reload

haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl reload haproxy

6. Backup & restore

Back up example.pem (it contains the private key — restrict its permissions). To restore, put it back and reload HAProxy.

← Docs