Let's say that we have haproxy in front of 2 apache:

                     +----> Apache (
Haproxy ( --|
                     +----> Apache (
  • Haproxy is configured to load balance traffic based on URI (needs to see URI so have to see content of HTTP)
  • Apache is hosting a large amount of domains
  • Every domain is accessible in HTTPS via haproxy that offloads SSL and initiate HTTP connection to Apache
  • Every domain has its own SSL certificate (no SAN or wildcard cert)

I saw that Haproxy allows us to give a directory with many certificates but I didn't manage to make it work with another thing that a single certificate.

Here is my (simplified) configuration:

        # Default SSL material locations
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private

        # Default ciphers to use on SSL-enabled listening sockets.
        ssl-default-bind-options no-sslv3

        # For backends connections
        ssl-default-server-options no-sslv3
        ssl-default-server-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS

frontend https_frontend
        bind ssl crt /etc/ssl/private/mycerts/mydomain.pem # HERE WE WANT A DIRECTORY INSTEAD OF A FILE
        default_backend apache_backend

backend apache_backend
        cookie SRVID insert indirect nocache

        # Backends
        server apache1 check maxconn 64
        server apache2 check maxconn 64

        # Load Balancing - URI Consistent
        balance uri
        hash-type consistent

        # Options
        option http-keep-alive

1 Answer 1


You could use the crt-list and point to a file containing the list of certificates, so your frontend would read as

frontend https_frontend
    bind ssl crt-list /etc/ssl/private/mycerts.txt
    default_backend apache_backend

And to generate the list just with something like find /etc/ssl/private/mycerts/ > /etc/ssl/private/mycerts.txt. See more information in https://cbonte.github.io/haproxy-dconv/configuration-1.6.html#5.1-crt-list

  • Thank you. I tried it and it worked well, but it obliges me to know every domain that has a certificate. Is there no other way to do this without listing certificates?
    – gr0bz
    Mar 15, 2017 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .