> ## Content Index
> Fetch the complete content index at: https://ostreff.info/llms.txt
> Use this file to discover other available public pages before exploring further.

# How To Secure HAProxy with Let's Encrypt
- URL: https://ostreff.info/how-to-secure-haproxy-with-lets-encrypt/
- Published: 2021-01-27T18:29:17.000Z
- Updated: 2021-01-31T10:46:23.000Z
- Author: Jordan Ostreff
- Tags: FreeBSD, HAProxy, Crypto

![HAProxy with Let's Encrypt TLS/SSL Certificate and Auto-renewal](https://assets.digitalocean.com/articles/letsencrypt/haproxy-letsencrypt.png)

Combine fullchain.pem and privkey.pem

> DOMAIN='example.com' ; sudo -E bash -c 'cat /usr/local/etc/letsencrypt/live/$DOMAIN/fullchain.pem /usr/local/etc/letsencrypt/live/$DOMAIN/privkey.pem > /usr/local/etc/haproxy/$DOMAIN.pem'

The first thing we want to add is a frontend to handle incoming HTTP connections, and send them to a default backend (which we’ll define later). At the end of the file, let’s add a frontend called **www-http**.

```
frontend www-http
   bind <haproxy_www_public_IP>:80
   reqadd X-Forwarded-Proto:\ http
   default_backend www-backend
```

Next, we will add a frontend to handle incoming HTTPS connections. At the end of the file, add a frontend called **www-https** \- enabling HTTP/2 and alpn extensions also.

```
frontend www-https
   bind <haproxy_www_public_IP>:443 ssl crt /usr/local/etc/haproxy/$DOMAIN.pem alpn h2,http/1.1
   reqadd X-Forwarded-Proto:\ https
   acl letsencrypt-acl path_beg /.well-known/acme-challenge/
   use_backend letsencrypt-backend if letsencrypt-acl
   default_backend www-backend
```

```
backend www-backend
   redirect scheme https if !{ ssl_fc }
   server www-1 www_1_private_IP:80 check
   server www-2 www_2_private_IP:80 check
```

```
backend letsencrypt-backend
   server letsencrypt 127.0.0.1:54321
```

> service haproxy restart

Then create /usr/local/bin/renew.sh script file:

```
#!/bin/sh

DOMAIN=example.com

# move to the correct let's encrypt directory
cd /usr/local/etc/letsencrypt/live/$DOMAIN

# cat files to make combined .pem for haproxy
cat fullchain.pem privkey.pem > /usr/local/etc/haproxy/$DOMAIN.pem

# reload haproxy
service haproxy reload
```

> chmod u+x /usr/local/bin/renew.sh

Edit with your favorite text editor the file /usr/local/etc/letsencrypt/renewal/$DOMAIN.conf and add or change the line like following:

```
http01_port = 54321
```

Test the whole configuration executing:

> certbot renew --dry-run

Then add the crontab entry like:

```
30 2 * * * /usr/local/bin/certbot renew --renew-hook "/usr/local/bin/renew.sh" > /dev/null
```

Source: [digitalocean.com](https://www.digitalocean.com/community/tutorials/how-to-secure-haproxy-with-let-s-encrypt-on-ubuntu-14-04?ref=ostreff.info)