# ACME Challenge Passthrough

**URL:** <https://discourse.haproxy.org/t/acme-challenge-passthrough/8739>\
**Category:** Configuration Samples\
**Created:** [June 5, 2023, 4:25am UTC](https://discourse.haproxy.org/t/acme-challenge-passthrough/8739 "2023-06-05T04:25:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![davidro](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/davidro/32/1969_2.png) [@davidro](https://discourse.haproxy.org/u/davidro)\
**Post date:** [June 5, 2023, 4:25am UTC](https://discourse.haproxy.org/t/acme-challenge-passthrough/8739/1 "2023-06-05T04:25:31Z")

</div>

Hi Community,

I am doing this in a homeserver set up so even though I use these platforms every day, they have a maximum of 3 - 4 users on them so all are single server, no need to load share etc.

My goal was to send the acme challenge for each server through haproxy and set and forget have lets encrypt renew in the background with no intervetion from me. The Apache2 - Certbout Auto-Renewal already was automating the requests I just needed them to route to the correct server as needed.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/9/98cd994d5ae8e49e0918acc0d4e3b3da727540ee.png)

After much trial and error here is my working config. When I add another backend server I will just need to expand the list of URLs. This config worked with the “certbot renew --dry-run” so now to leave it for a few months and see if nothing breaks.

```auto
global
  maxconn 5000
  stats timeout 30s
  log /dev/log local0
  log /dev/log local1 notice
  chroot /var/lib/haproxy
  user haproxy
  group haproxy
  daemon

defaults
  log global
  mode tcp
  option tcplog
  option dontlognull
  timeout http-request 5s
  timeout connect 5000
  timeout client 2000000
  timeout server 2000000
 
# front end acme challenge
frontend example80
  bind *:80
  mode http
  option tcplog

# check for acme challange and validate url

    acl test_acme path_beg /.well-known/acme-challenge/
    acl nc_host hdr(host) -i nc.example.com
    acl wp_host hdr(host) -i wp.example.com
    acl wiki_host hdr(host) -i wiki.example.com

# if no acme challenge redirect https
    redirect scheme https code 301 if !test_acme

# on acme challenge forward :80 to backend server
    use_backend le_nc_backend if test_acme nc_host
    use_backend le_wp_backend if test_acme wp_host
    use_backend le_wiki_backend if test_acme wiki_host

# frontend normal https traffic to valid urls
frontend example443
  bind *:443
  mode tcp
  option tcplog

  tcp-request inspect-delay 10s
  tcp-request content accept if { req.ssl_hello_type 1 }

  use_backend backend_nc if { req.ssl_sni -m end nc.example.com }
  use_backend backend_wp if { req.ssl_sni -m end wp.example.com }
  use_backend backend_wiki if { req.ssl_sni -m end wiki.example.com }

# Backend nextcloud server <<<<<<<<<
# Normaltraffic nextcloud
backend backend_nc
  mode tcp
  server nextcloud-server 192.168.1.10:443 check

# Renew certificate nextcloud server
backend le_nc_backend
  mode http
  server letsencrypt_nc_server 192.168.1.10:80 check

# Backend wordpress server <<<<<<<<<
# Normaltraffic worpress
backend backend_wp
  mode tcp
  server wordpress-server 192.168.1.20:443 check

# Renew certificate wordpress server
backend le_wp_backend
  mode http
  server letsencrypt_wp_server 192.168.1.20:80 check

#Backend wiki server <<<<<<<<<<
# Normaltraffic wiki server
backend backend_wiki
  mode tcp
  server wiki-server 192.168.1.30:443 check

# Renew certificate wiki server
backend le_wiki_backend
  mode http
  server letsencrypt_wiki_server 192.168.1.30:80 check

```

Feedback welcome, I am always happy to improve my setup.

---

<div class="post-metadata">

**Author:** ![davidro](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/davidro/32/1969_2.png) [@davidro](https://discourse.haproxy.org/u/davidro)\
**Post date:** [August 15, 2023, 11:38pm UTC](https://discourse.haproxy.org/t/acme-challenge-passthrough/8739/2 "2023-08-15T23:38:48Z")

</div>

Hi Community,

Just a follow up, I just checked and all of my servers have successfuly renewed their certificates over the last few weeks.

Dave

---

<div class="post-metadata">

**Author:** ![matthieutalbot](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/matthieutalbot/32/2480_2.png) [@matthieutalbot](https://discourse.haproxy.org/u/matthieutalbot)\
**Post date:** [October 9, 2025, 8:26pm UTC](https://discourse.haproxy.org/t/acme-challenge-passthrough/8739/3 "2025-10-09T20:26:24Z")

</div>

@davidro you are my hero ! I was having one frontend for 80 and 443, and having two different frontend and only 301 if !test\_acme is the key that solved it for me as well.