Configure HAProxy

4min
To use the  for TLS offloading, perform the tasks in this section, which show how to configure HAProxy to use the TLS server certificate you created previously, along with pkcs11-provider for TLS offloading.
If you installed HAProxy through your Linux distribution default package manager, the HAProxy configuration directory is located at /etc/haproxy/. 
1 | Create a directory for HAProxy TLS PKI
1
Create a directory inside /etc/haproxy/ named tls.
2
Move the HAProxy TLS server certificate (haproxy-cert.pem) and private key reference object file (haproxy-cert.pem.key) into the /etc/haproxy/tls/ directory.
2 | Edit the HAProxy configuration file
1
Open the /etc/haproxy/haproxy.cfg file in a text editor.
2
Configure HAProxy to use pkcs11-provider by defining the following lines in the global section:
Text
global
    ssl-provider-path /usr/lib/x86_64-linux-gnu/ossl-modules
    ssl-provider pkcs11
    ssl-provider default
global
    ssl-provider-path /usr/lib/x86_64-linux-gnu/ossl-modules
    ssl-provider pkcs11
    ssl-provider default
﻿
3
At the bottom of the file, define the frontend and backend configuration:
Text
# ----------------------- Frontend section -----------------------
frontend https-in
    bind *:443 ssl crt /etc/haproxy/tls/haproxy-cert.pem
    mode http
    default_backend webservers

# ----------------------- Backend section ------------------------
backend webservers
    mode http
    balance roundrobin
    server web1 127.0.0.1:8080 check
# ----------------------- Frontend section -----------------------
frontend https-in
    bind *:443 ssl crt /etc/haproxy/tls/haproxy-cert.pem
    mode http
    default_backend webservers

# ----------------------- Backend section ------------------------
backend webservers
    mode http
    balance roundrobin
    server web1 127.0.0.1:8080 check
﻿
Explanation
bind *:443 ssl crt /etc/haproxy/tls/haproxy-cert.pem
This instructs HAProxy to listen on port 443 using SSL, loading the certificate from /etc/haproxy/tls/haproxy-cert.pem. HAProxy knows how to find the /etc/haproxy/tls/haproxy-cert.pem.key file because you gave it the same file name as the certificate, but with the .key extension.
mode http ensures that HAProxy treats traffic as HTTP after decryption.
default_backend webservers sends traffic to a backend block named webservers.
The backend block can forward requests to one or more servers (in this case, only 127.0.0.1:8080). For testing purposes, you can spin up a web server by running the following command in a separate terminal window:
Shell
python3 -m http.server 8080
python3 -m http.server 8080
﻿
4
Save the changes to the /etc/haproxy/haproxy.cfg file. 
5
Confirm the configuration is valid by running the following command:
Shell
haproxy -c -f /etc/haproxy/haproxy.cfg
haproxy -c -f /etc/haproxy/haproxy.cfg
﻿
3 | Restart HAProxy to apply changes
1
Run the following command to restart the HAProxy service:
Shell
sudo systemctl restart haproxy
sudo systemctl restart haproxy
﻿
2
Confirm that new entries populated in the  PKCS #11 log file (fxpkcs11.log) during the restart process, which indicates that HAProxy is successfully communicating with the . 
4 | Test HAProxy TLS offloading
1
Run the following command to confirm HAProxy TLS offloading is working as intended:
Shell
curl -Ik https://127.0.0.1/
curl -Ik https://127.0.0.1/
﻿
If TLS negotiation is successful, you see the following message:
Text
HTTP/1.1 200 OK
HTTP/1.1 200 OK
﻿
﻿
Generate an HAProxy server certificate for testing