Skip to main content
To use the CryptoHub for TLS offloading, perform the tasks in this section, which show how to configure HAProxy to use the TLS server certificate you created previously, along with pkcs11-provider for TLS offloading. If you installed HAProxy through your Linux distribution default package manager, the HAProxy configuration directory is located at /etc/haproxy/.

​
Edit the configuration file

Perform the following steps to edit the HAProxy configuration file:
1
Open the /etc/haproxy/haproxy.cfg file in a text editor.
2
Configure HAProxy to use pkcs11-provider by defining the following lines in the global section:
None
3
At the bottom of the file, define the frontend and backend configuration:
None
The following points explain aspects of the preceding code:-bind *:443 ssl crt /etc/haproxy/tls/haproxy-cert.pem
  • This instructs HAProxy to listen on port 443 using SSL, loading the certificate from /etc/haproxy/tls/haproxy-cert.pem. HAProxy knows how to find the /etc/haproxy/tls/haproxy-cert.pem.key file because you gave it the same file name as the certificate, but with the .key extension.
  • mode http ensures that HAProxy treats traffic as HTTP after decryption.
  • default_backend webservers sends traffic to a backend block named webservers.
  • The backend block can forward requests to one or more servers (in this case, only 127.0.0.1:8080). For testing purposes, you can spin up a web server by running the following command in a separate terminal window:
    Shell
4
Save the changes to the /etc/haproxy/haproxy.cfg file.
5
Confirm the configuration is valid by running the following command:
Shell

​
Run HAProxy as a systemd service

When HAProxy runs as a systemd service, it defaults to master-worker mode, which forks a worker process to handle traffic. PKCS #11 modules are designed to be initialized and used within a single process — after a fork(), the PKCS #11 standard requires resources to be reinitialized in the child process. Running HAProxy in single-process mode keeps the PKCS #11 module initialized and used in the same process, which is the recommended configuration for TLS offloading through an HSM. Perform the following steps to configure HAProxy to run as a single process under systemd:
1
In the /etc/haproxy/haproxy.cfg file, under the global section, comment out daemon by adding a # at the beginning of the line:
None
2
Run the following command to edit the HAProxy systemd service file:
Shell
Add the following into the file:
The -db option runs HAProxy as a single foreground process (no fork), and Type=exec lets systemd supervise it directly. The $EXTRAOPTS argument from the default service file is intentionally omitted here, because it supplies the master-worker control socket (-S /run/haproxy-master.sock), which is not used in single-process mode.
3
Run the following command to reload the systemd configuration:
Shell
In single-process mode, configuration reloads restart the process rather than performing a seamless (hitless) reload. For a TLS-offloading front end, this is typically acceptable. Multi-threading within the single process is unaffected — you can still tune nbthread as needed.

​
Restart HAProxy

Perform the following steps to restart HAProxy to apply changes:
1
Follow the fxpkcs11.log file in a terminal window to monitor the log output from the Futurex PKCS #11 library:
Shell
This is the default log location for the Futurex PKCS #11 library, but if you have configured a different location in the fxpkcs11.cfg file, update the path accordingly.
2
Run the following command to restart the HAProxy service:
Shell
Confirm that new entries populated in the Futurex PKCS #11 log file during the restart process, which indicates that HAProxy is successfully communicating with the CryptoHub.

​
Test HAProxy

When HAProxy performs TLS offloading, not every request triggers a new signing operation, so you may not see a signing entry in fxpkcs11.log for every request. To reliably capture signing operations, enable console logging by setting the following line in the fxpkcs11.cfg file:
Because the service runs in the foreground under systemd, these log entries are captured by the journal. Monitor them with the following command:
Run the following command to confirm HAProxy TLS offloading is working as intended:
Shell
If TLS negotiation is successful, HAProxy returns the response from the backend server (for example, HTTP/1.1 200 OK when the test web server is running).If the backend server is not running, you may instead receive a 503 Service Unavailable response. This still indicates that TLS offloading succeeded — HAProxy completed the TLS handshake using the HSM-stored key and then attempted to reach the backend. To get a 200 OK, ensure the test web server is running (see the backend configuration step).