I have a web app which offers a subdomain to each customer. Currently all the customer subdomains (e.g. user1.example.com, user2.example.com) and the root domain (i.e. www.example.com, example.com) are secured with a single wildcard certificate.

Now I would like to use an Extended Validation certificate for the root domain and keep using the wildcard certificate for the subdomains.

Is it possible to configure HAProxy to serve a different certificate based on that condition? Is it possible to have just one backend and only use a different certificate?

This question is different from this one because in my case both certificates would be valid for the root domain, so HAProxy can't figure out automatically which certificate should use. I need a way to explicitly set which certificate should be used based on the requested domain (SNI). Indeed for the root domain I want to use the EV certificate (instead of the wildcard one).


Well actually you are in luck. If you configure haproxy to use both certs, either by putting them in the same directory and listing that, or by listing both certs explicitely, HAProxy will do the right thing for you. I have posted about this on the mailing list of haproxy. The relevant bit about the crt directive is:

This directive may be specified multiple times in order to load certificates from multiple files or directories. When specified multiple times, the certificates will be looked up in the order they are specified in the configuration, with the exception of wildcard certificates, they will always be looked up last.

As an alternative you can have a look at crt-list.

  • 1
    This works really damn well, we use it with an external cert primary and an internal cert that supports diagnostic endpoints (different subdomain) – Jacob Evans Sep 29 '17 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.