# TLS Termination
**URL:** https://discourse.haproxy.org/t/tls-termination/2747
**Category:** Help!
**Created:** [July 18, 2018, 2:54pm UTC](https://discourse.haproxy.org/t/tls-termination/2747 "2018-07-18T14:54:30Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@multiplier\_x](https://discourse.haproxy.org/u/multiplier_x)
#### Post date: [July 18, 2018, 2:54pm UTC](https://discourse.haproxy.org/t/tls-termination/2747/1 "2018-07-18T14:54:30Z")
We collect log files on one site and then send them over the internet via TCP + TLS to our servers in the cloud. The log files need to be sent evenly between the two servers, so we have put HAProxy infront of them.
Currently the only config I have added to get the connection from the local server to the servers in the cloud via HAPRoxy is:
```
listen graylog
bind *:20000
mode tcp
option tcplog
balance roundrobin
server graylog1 10.32.4.4:20001 check
server graylog2 10.32.4.5:20001 check
```
I believe I need to terminate TLS at the HAProxy server, how would I go about doing this?
Cheers,
G
---
### Author:  [@multiplier\_x](https://discourse.haproxy.org/u/multiplier_x)
#### Post date: [July 23, 2018, 2:42pm UTC](https://discourse.haproxy.org/t/tls-termination/2747/2 "2018-07-23T14:42:54Z")
I’ve still got nowhere, can anyone help?
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 30, 2018, 9:57am UTC](https://discourse.haproxy.org/t/tls-termination/2747/3 "2018-07-30T09:57:00Z")
What do you need to encrypt: client to haproxy, haproxy to backend servers, or both? Do you have a certificate ready to be installed on haproxy?
---
### Author:  [@multiplier\_x](https://discourse.haproxy.org/u/multiplier_x)
#### Post date: [July 30, 2018, 10:13am UTC](https://discourse.haproxy.org/t/tls-termination/2747/4 "2018-07-30T10:13:12Z")
So the logs come to HAproxy encrypted, we want to decrypt them at that point and send them in plaintext from the backend. I am about to set up a certificate for it now.
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 30, 2018, 10:36am UTC](https://discourse.haproxy.org/t/tls-termination/2747/5 "2018-07-30T10:36:10Z")
Ok, the add `ssl crt /path/to/certificate` to the bind line.
You can find a more complete and secure example here:
[https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy-1.7.9&openssl=1.0.1e&hsts=yes&profile=intermediate](https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=haproxy-1.7.9&openssl=1.0.1e&hsts=yes&profile=intermediate)
---
### Author:  [@multiplier\_x](https://discourse.haproxy.org/u/multiplier_x)
#### Post date: [July 30, 2018, 10:42am UTC](https://discourse.haproxy.org/t/tls-termination/2747/6 "2018-07-30T10:42:21Z")
I have added that option and it doesn’t seem to have worked.
```
frontend gl-frontend
mode tcp
default_backend gl-cluster
bind *:20000 ssl crt /etc/certs/ha-selfsigned.pem
backend gl-cluster
mode tcp
balance roundrobin
server GL1 10.19.0.4:20001
server GL2 10.19.0.5:20001
```
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 30, 2018, 10:58am UTC](https://discourse.haproxy.org/t/tls-termination/2747/7 "2018-07-30T10:58:54Z")
Doesn’t work how? Can you elaborate a little bit?
---
### Author:  [@multiplier\_x](https://discourse.haproxy.org/u/multiplier_x)
#### Post date: [July 30, 2018, 11:14am UTC](https://discourse.haproxy.org/t/tls-termination/2747/8 "2018-07-30T11:14:58Z")
Okay so the ssl termination is now working, but it only sends to one host. The connection is never broken.
Edited:
We send the data on from the proxy to two nodes and we are only seeing one connection being made to one node and the connection is never broken and therefore data is never send to the other node.
---
### Author:  [@multiplier\_x](https://discourse.haproxy.org/u/multiplier_x)
#### Post date: [July 30, 2018, 1:32pm UTC](https://discourse.haproxy.org/t/tls-termination/2747/9 "2018-07-30T13:32:37Z")
So the connection when sending the logs from one site to another is just one long TCP connection that sends all the logs. Obviously haproxy is set up to balance the TCP connections and when there’s only one, it will just go to one node. Is there anyway to resolve this?
---
### Author:  [@lukastribus](https://discourse.haproxy.org/u/lukastribus)
#### Post date: [July 30, 2018, 2:30pm UTC](https://discourse.haproxy.org/t/tls-termination/2747/10 "2018-07-30T14:30:22Z")
To load-balance you need multiple sessions. If there is only one session, only one server will see the load.
This is especially true in TCP mode, as haproxy does not understand and interact at application layer, but on layer 4 (TCP) only.