# HAProxy & Cloudflare - 526 Invalid SSL

**URL:** <https://discourse.haproxy.org/t/haproxy-cloudflare-526-invalid-ssl/9990>\
**Category:** Help!\
**Created:** [July 3, 2024, 5:32pm UTC](https://discourse.haproxy.org/t/haproxy-cloudflare-526-invalid-ssl/9990 "2024-07-03T17:32:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![MrGamecase](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/mrgamecase/32/2249_2.png) [@MrGamecase](https://discourse.haproxy.org/u/MrGamecase)\
**Post date:** [July 3, 2024, 5:32pm UTC](https://discourse.haproxy.org/t/haproxy-cloudflare-526-invalid-ssl/9990/1 "2024-07-03T17:32:13Z")

</div>

Hi All,

Firstly HI! im new here an i apoligise if this is in the wrong location…

Been having some issues setting up HAProxy as a reverse proxy for my services. What i aim to achieve is use Cloudflare network to access my services securely over the wan. have ha proxy handle my services that are on the same ports [80 / 443] i have a couple i cannot change the port numbers and can not run through the Cloudflare ZTP tunnel service as it would be a breach of service.

So I have managed to get everything installed and setup [To the best of my knowledge] but i receive Cloudflare Error 526 - invalid SSL. Any help fixing this error would be greatly appreciated

Please see my configs and methodology below

**I am aware internal IPs are on show this is a test network that will be terminated after this posting.**

**!!! ALL CONFIGS HAVE BEEN ANONYMISED & GIVE NO REVELLING INFO !!!**

# - PFSense

###### - GUI Port change

Going into the system Advance tab I moved the default port for PFSense GUI [443] to a secure port for my admin network [FIG 1].

###### - Aliases Creation

Using the firewall tab I created aliases for the following [FIG 2]…

- IP Networks[[Contains all cloudflares proxy networks](https://www.cloudflare.com/en-gb/ips/)] up too date as of 2023
- Prots required for HAProxy [80 & 443]

###### - Port Forwarding

Again using the firewall tab I created a port forward from WAN to firewall itself [as HAProxy has been installed on the firewall] using the aliases created above, I have limited the source to cloudflare proxy networks as the DNS config on cloudflare will be proxied [FIG 3].

###### - Certification

Using the system tab i uploaded my cloudflare origin certificate, key & cloudflare authorities certificate [FIG 4].

###### - HAProxy

Using the services tab i configured HAProxy, I created a backend [In this example i’m using PLEX], gave it a name server listing & disabled health checking. No SSL was added here as the server does not have any ssl certificates setup [FIG 5].

I created a shared front end for HTTP:// & HTTPS://. Under External addresses i selected WAN - Ports 80 / 443, click the SSL Offloading next to 443 & confirmed that type was set to http / https (Offloading) [FIIG 6].

I created an ACL for PLEX & An Action too be taken if the ACL is triggered [FIG 7]

Under SSL Offloading I selected my SSL Certificate i uploaded earlier [FIG8].

From what i can gather i have setup the PFSense box & haProxy to in theory successfully proxy my internal services.

> **Images**
>
> FIG 1
> 
> ![01 - Gui Port](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/2/2a15dd883e1ff634aab2133b6bf69f3d2d41b17d.png)
> 
> FIG 2
> 
> ![02 - Alias Networks](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/8/81323bff080af5066af5d6727148f30bf6376f62.png)  
> ![02 - Alias Port](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/d/dfebee2229fd1b6ad66995410fe6ee966502de50.png)
> 
> FIG 3
> 
> ![03 - Port Forward](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/8/8389df4a689eb431e2b63295fc788c1e68d7ac75.png)
> 
> FIG 4
> 
> ![04 - Cloudflare CA](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/e/e280b7b6138055d77f0f2bb3fe9e3f65256262b4.png)  
> ![04 - Cloudflare Origin](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/f/f4626d9520bd545b2fdd98617e742b7ebccfc1b4.png)
> 
> FIG 5
> 
> ![05 - HAProxy server list](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/6/6043a7ee68b32a1ec0ca7f80113a0d0eef959d2f.png)  
> ![05 - HAProxy no health](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/d/dadde29384a64e602cbb0c28e94361f055d96a84.png)
> 
> FIG 6
> 
> ![06 - HAProxy Frontent 1](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/0/04a049c4ff48ccc5c4c448cb0bb5c94ea48c716a.png)  
> ![06 - HAProxy Frontend 2](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/1/195b124868905aff940aab54b8b6d2fdc11a9958.png)
> 
> FIG 7
> 
> ![07 - HAProxy 3](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/8/848d773ecb96548cdf047ba6da8eae46fae6c6eb.png)  
> ![07 - HAProxy 4](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/3/33c12dd9935ce1f3398244cf8fd005ea529b5d03.png)
> 
> FIG 8
> 
> ![08 - HAProxy SSL](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/6/66ad9f9ba1cbdf5a6d097a987945f06650785f99.png)

# - Cloudflare

###### - DDNS Magic

So i have had do a bit of black magic here as my ISP does not offer static IPs & the DHCP Leases are stupidly short.

Using my PFSense box i have had to setup a proxied DDNS, so i’m using Cloudflare to do this as-well. PFSense logs into my cloudflare account via a dedicated API Token allowing it to read my Domains DNS & update an A record with my external ip every 30 Mins.

###### - DNS Record for HAProxy

I have created a Cname record for plex pointing towards the A record updated by PFSense DDNS system this to is proxied [FIG 1].

> **Images**
>
> FIG 1
> 
> ![Screenshot 2024-07-03 at 3.01.44 am](https://us1.discourse-cdn.com/flex016/uploads/haproxy/original/2X/2/2dc9af421cc15d5199f4ae717883d34c8e717d8c.png)