# Setting up imaps with haproxy and local certs?

**URL:** <https://discourse.haproxy.org/t/setting-up-imaps-with-haproxy-and-local-certs/8063>\
**Category:** Help!\
**Created:** [October 28, 2022, 6:42am UTC](https://discourse.haproxy.org/t/setting-up-imaps-with-haproxy-and-local-certs/8063 "2022-10-28T06:42:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![baradhili](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@baradhili](https://discourse.haproxy.org/u/baradhili)\
**Post date:** [October 28, 2022, 6:42am UTC](https://discourse.haproxy.org/t/setting-up-imaps-with-haproxy-and-local-certs/8063/1 "2022-10-28T06:42:14Z")

</div>

Slowly going crazy here…  
have setup haproxy using this [Set Up SMTP and IMAP Proxy with HAProxy (Debian, Ubuntu, CentOS)](https://www.linuxbabe.com/mail-server/smtp-imap-proxy-with-haproxy-debian-ubuntu-centos)

it gets part of the way there, but I want to use my letsencrypt cert that I have available on the proxy box instead of trying to convince my internal dovecot to provide imaps - so basically offload SSL at the proxy

but I have no idea how to tell haproxy to provide imap:993 with the correct certs?

Probably just failing to read the rtfm properly

Also want to do the same with smtps:465

---

<div class="post-metadata">

**Author:** ![baradhili](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@baradhili](https://discourse.haproxy.org/u/baradhili)\
**Post date:** [February 23, 2023, 5:19am UTC](https://discourse.haproxy.org/t/setting-up-imaps-with-haproxy-and-local-certs/8063/2 "2023-02-23T05:19:49Z")

</div>

because someone might find this…

I fixed it by

- merging fullchain and key into a cert - eg. cat /etc/letsencrypt/live/external.XXX.com/fullchain.pem /etc/letsencrypt/live/external.XXX.com/privkey.pem | tee /etc/haproxy/external.XXX.com.pem

- referring to this combined pem file in the config e.g. bind \*:993 ssl crt /etc/haproxy/external.XXX.com.pem

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [February 23, 2023, 8:27am UTC](https://discourse.haproxy.org/t/setting-up-imaps-with-haproxy-and-local-certs/8063/3 "2023-02-23T08:27:29Z")

</div>

This only works for ports with implicit SSL. It cannot work with STARTTLS based approaches:

> [@Terminating opportunistic TLS (STARTTLS)](https://discourse.haproxy.org/t/terminating-opportunistic-tls-starttls/3681/2):
>
> No, because this is negotiated at application layer which means haproxy would actually have to implement at least a part of the handshake of every single one of those protocols. No, because there would already have been a POP/IMAP/SMTP handshake with some other backend. For this to work haproxy would have to intercept the handshake of all those protocols and insert a STARTTLS negotiation.

> [@SMTP & IMAP proxy based on domain (pass-through)](https://discourse.haproxy.org/t/smtp-imap-proxy-based-on-domain-pass-through/5480/2):
>
> No, this is not really possible, because you have to support a) cleartext and b) STARTTLS, neither allows SNI based routing decisions, because the SNI value, if it exist at all, is not in the first packet. You can only do this with implicit TLS, meaning imaps on TCP Port 993 and SMTP submission with implicit TLS on port 465. Port 587 is unencrypted until you start the TLS session with STARTTLS. It’s therefor impossible to route based on SNI. I don’t think SNI contains the domain. It usually …