Installing an SSL certificate on HAProxy

HAProxy is the odd one out: it wants the certificate, the intermediates and the private key concatenated into a single PEM file.

cat fullchain.pem example.com.key > /etc/haproxy/certs/example.com.pem
chmod 600 /etc/haproxy/certs/example.com.pem

frontend https
    bind *:443 ssl crt /etc/haproxy/certs/example.com.pem alpn h2,http/1.1
    bind *:80
    http-request redirect scheme https unless { ssl_fc }
    default_backend app

backend app
    server app1 127.0.0.1:8080 check

haproxy -c -f /etc/haproxy/haproxy.cfg && systemctl reload haproxy

Point crt at a directory instead of a file and HAProxy loads every certificate in it, picking one per SNI — the usual way to host many domains on one frontend.

Verify it from the outside

A config that reloads without error can still be serving the wrong file, and your own browser will hide a missing intermediate because it caches them from other sites. Check what HAProxy actually presents:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

Or use the Domain SSL Checker, which performs the same handshake from this server and flags an incomplete chain explicitly.

Installing an SSL certificate on HAProxy

Verify it from the outside

Other platforms