Purinda Gunasekara

Complete Guide on Setting up HAProxy to Terminate SSL Generated by LetsEncrypt (certbot)

· updated · #linux · 6 min read

DNS Configuration for Your Domain

Before generating SSL certificates with Let’s Encrypt or any other certificate authority, you need to have proper DNS configuration for the domain you are trying to generate certificates for. This involves ensuring that the domain’s name servers are correctly set up and pointing to the appropriate DNS provider.

Here are the general steps to configure DNS name servers for the domain:

  1. Choose a DNS provider: Select a DNS provider that you prefer to use for managing your domain’s DNS records. Popular DNS providers include Cloudflare, Amazon Route 53, Google Cloud DNS, and many others. Register an account with the chosen provider if you haven’t done so already.
  2. Set the name servers: Access your domain registrar’s control panel or website and update the domain’s name servers to point to the DNS provider you selected. This process may vary depending on your domain registrar, but generally, you’ll find an option to modify the name servers or DNS settings for your domain. Enter the names of the DNS provider’s name servers provided to you by the provider.
  3. Configure DNS records: Once the domain’s name servers are set to the DNS provider, you can configure the necessary DNS records for your domain. At a minimum, you’ll need to set the A or CNAME record for your domain to point to the IP address or hostname of your server where HAProxy is running. Additionally, if you want to use subdomains, you may need to set appropriate DNS records such as A or CNAME records for them.
  4. DNS propagation: DNS changes typically take some time to propagate across the internet. It may take anywhere from a few minutes to several hours for the DNS changes to propagate fully. During this period, the domain’s name servers will update, and the changes you made will become effective.

After the DNS configuration is complete, you can proceed with generating SSL certificates using Let’s Encrypt or any other certificate authority. The certificate authority will validate the domain ownership through DNS records, so it’s crucial to ensure proper DNS configuration before attempting to generate SSL certificates.

Keep in mind that specific DNS configuration steps and terminology may vary depending on the DNS provider and domain registrar you’re using. It’s recommended to refer to the documentation or support resources provided by your chosen DNS provider and domain registrar for detailed instructions on configuring DNS name servers for your domain.

Setup Certbot on Your Server (for generating certificates)

Read the following article https://certbot.eff.org/instructions on how you need to install Certbot (CLI) tool which we will be using to generate the SSL certificates.

Once the DNS configuration is setup as per prior instructions you need to install the correct certbot plugin for the DNS provider. All supported plugins are listed here https://eff-certbot.readthedocs.io/en/stable/using.html#dns-plugins

For example, I was using Cloudflare as my DNS provider (I had to configure NS records in CrazyDomains where my domain was registered). I had to retrieve the API Token from Cloudflare and run the command below to generate the SSL certificates

sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/cloudflare-api-token.ini -d *.mydomain.com -d mydomain.com

Note that the file ~/.secrets/cloudflare-api-token.ini contained the API Token from Cloudfare and setup with a similar structure as below

# Cloudflare API token used by Certbot
dns_cloudflare_api_token = xxxxxxxxxxxxxxxxxxxxxx

Failing to verify DNS challenge

However, if you get such as “Challenge Failed” with your domain name, the issue could be due to TXT DNS entry Certbot requires at the DNS server level is not setup correctly.

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-cloudflare, Installer None
Requesting a certificate for *.mydomain.com.au and mydomain.com.au
Performing the following challenges:
dns-01 challenge for mydomain.com.au
dns-01 challenge for mydomain.com.au
Waiting 10 seconds for DNS changes to propagate
Waiting for verification...
Challenge failed for domain mydomain.com.au
dns-01 challenge for mydomain.com.au
Cleaning up challenges
Some challenges have failed.

Run the below command to get the _acme-challenge.mydomain.com.au content for TXT entry which need to be setup at DNS provider level.

sudo certbot certonly --manual --preferred-challenges dns -d "*.mydomain.com.au" -d mydomain.com.au

Sample output

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Requesting a certificate for *.mydomain.com.au and mydomain.com.au
Performing the following challenges:
dns-01 challenge for mydomain.com.au

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.mydomain.com.au with the following value:

W-GkRE7-akdjsjcxkjasdQWEqwdascCDSFsdfsdCXA1

Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges

Now, copy the challenge content (“W-GkRE7-akdjsjcxkjasdQWEqwdascCDSFsdfsdCXA1”) and add it as a TXT DNS entry against your domain.

Setup HAProxy

Great! Setting up HAProxy on a Debian Linux server can be a useful way to load balance incoming traffic to multiple backend servers. Here’s a step-by-step guide to help you get started:

Update your system: Ensure that your Debian server is up to date by running the following commands

sudo apt update
sudo apt upgrade

Install HAProxy: Use the package manager apt to install HAProxy

sudo apt install haproxy

Configure HAProxy: The main configuration file for HAProxy is located at /etc/haproxy/haproxy.cfg. Open the file using your preferred text editor:

sudo nano /etc/haproxy/haproxy.cfg

Configure frontend and backend sections: Within the haproxy.cfg file, you’ll define frontend and backend sections.

frontend myfrontend
    bind *:443 ssl crt /etc/letsencrypt/archive/<domain>/haproxy_ssl.pem
    mode http
    default_backend mybackend

In order to generate HAProxy compatible certificate bundle (haproxy_ssl.pem), you need to combine cert1.pem and privkey1.pem files generated by Certbot together and generate a single file. I used the below command to do that after navigating to the location where Certbot stores domain specific secrets (for my setup it was /etc/letsencrypt/archive/<domain>)

cat cert1.pem privkey1.pem > haproxy_ssl.pem

Backend configuration: The backend section defines the servers that HAProxy will load balance traffic to. Specify the backend servers and their respective addresses and ports. Here’s an example configuration

backend mybackend
    mode http
    balance roundrobin
    server server1 192.168.0.1:80 check
    server server2 192.168.0.2:80 check

In this example, HAProxy will load balance incoming HTTP traffic to server1 and server2 using the round-robin algorithm

Save and exit: After making the necessary configurations, save the haproxy.cfg file and exit your text editor

Start HAProxy: Once you’ve configured HAProxy, start the service using the following command

sudo systemctl start haproxy

That’s it! You have now set up HAProxy on your Debian Linux server. You can further customize the configuration file to meet your specific requirements. Remember to monitor the HAProxy logs (/var/log/haproxy.log) for any issues or errors