I messed around with my haproxy.cfg since I would like to differ between two servers, a cms.mydomain.org and a www.mydomain.org . Backend is a Tomcat9 server. While in a former configuration my fullchain.pem worked, haproxy suddenly doesn’t care about that certificate and the browser (FF) says I were…

If you configure haproxy to use the certificate in /etc/haproxy/fullchain.pem it will do exactly that. Nothing more, nothing less. Based on your description there is no way for us to know what may be wrong in your environment.

Yeah, but /etc/haproxy/fullchain.pem is not a self signed certificate, it’s a Letsencrypt one. It may not contain the domain that is adressed in the HTTP-request but it looks to me as though haproxy falls back to some “self signed certificate”, whatever that may be and whereever it takes it from.

Haproxy certainly does not do that. Perhaps you have a software or hardware Firewall with SSL inspection enabled between your client and the server, and because the name does not match, the Firewall replaces and intercept the certificate. Or perhaps you have an old haproxy instance running in the …

Your guess about multiple haproxy can be right: ps ax | grep haproxy 127487 pts/1 S 0:00 /usr/local/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /run/haproxy-master.sock 127489 pts/1 Sl 0:09 /usr/local/sbin/haproxy -Ws -f /etc/haproxy/haproxy.cfg -p /run/hap…

Also see post #7 here: [image] Haproxy returns 403 NOSRV error intermittently Help! For a clean situation, stop all haproxy processes and kill all the rest, and then start it. Check the process table to see a “normal” situation. Reload and restart haproxy a few teams then…

I believe, killing is not as easy, since they refork when you say killall haproxy. But I got it managed. Rebooted. :slight_smile: Interesting point, the SOREUSPORT thing. My first idea was that I was wondering about two haproxy instances being able to run on a claimed socket/port.

Haproxy 2.8 uses self signed certificate - where does it take it from?

Help!

lukastribus November 9, 2023, 4:06pm 6

Also see post #7 here:

Topic		Replies	Views
Certificate/SSL termination problem Help!	3	1842	June 3, 2016
Haproxy as server with CA signed cert to fetch self-signed client certificate Help!	5	7721	August 11, 2016
We have to install haproxy with binary with ssl enabled Help!	15	1192	December 6, 2020
Ignore autosigned Certificate Help!	4	717	March 11, 2020
Trying to install SSL Cert for use with HAPROXY. No luck Help!	10	11289	January 7, 2019

Haproxy 2.8 uses self signed certificate - where does it take it from?

Related topics