# SSL termination on whole domain

**URL:** <https://discourse.haproxy.org/t/ssl-termination-on-whole-domain/5293>\
**Category:** Help!\
**Created:** [May 29, 2020, 10:53am UTC](https://discourse.haproxy.org/t/ssl-termination-on-whole-domain/5293 "2020-05-29T10:53:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![edamber](https://avatars.discourse-cdn.com/v4/letter/e/ccd318/32.png) [@edamber](https://discourse.haproxy.org/u/edamber)\
**Post date:** [May 29, 2020, 10:53am UTC](https://discourse.haproxy.org/t/ssl-termination-on-whole-domain/5293/1 "2020-05-29T10:53:50Z")

</div>

Hello!

So I’m trying to do SSL termination in HAproxy. I decided to do it all there because I’ve heard I can use on certificate for all our clients. Ive tried to set this up and the certs work for the ones I’m testing with but the websites return Error 400 - Bad request.

Another thing I’m wondering is can I issue a cert for the whole of kulturhotell.se so that I can use that one cert for all the websites? How does that work? After that I could use seperate certs for the few that has their own domains.

Here is the config:

global  
log /dev/log local0  
log /dev/log local1 notice  
chroot /var/lib/haproxy  
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners  
stats timeout 30s  
user haproxy  
group haproxy  
daemon

```
    # Default SSL material locations
    ca-base /etc/ssl/certs
    crt-base /etc/ssl/private

    # See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

```

defaults  
log global  
option httplog  
option dontlognull  
timeout connect 5000  
timeout client 50000  
timeout server 50000  
errorfile 400 /etc/haproxy/errors/400.http  
errorfile 403 /etc/haproxy/errors/403.http  
errorfile 408 /etc/haproxy/errors/408.http  
errorfile 500 /etc/haproxy/errors/500.http  
errorfile 502 /etc/haproxy/errors/502.http  
errorfile 503 /etc/haproxy/errors/503.http  
errorfile 504 /etc/haproxy/errors/504.http

frontend http  
bind \*:80  
bind \*:443 ssl crt /etc/ssl/sofietst.kulturhotell.se/sofietst.kulturhotell.se.pem crt /etc/ssl/cluster.kulturhotell.se/cluster.kulturhotell.se.pem  
redirect scheme https code 301 if !{ ssl\_fc }  
option tcplog  
mode tcp  
acl letsencrypt-acl path\_beg /.well-known/acme-challenge/  
use\_backend letsencrypt-backend if letsencrypt-acl  
default\_backend web.kh.vbm.se

backend web.kh.vbm.se  
balance roundrobin  
option ssl-hello-chk  
mode tcp  
server web-01 192.168.11.100:443 check  
server web-02 192.168.11.101:443 check

backend letsencrypt-backend  
server letsencrypt 127.0.0.1:8888