What is recommended configuration for using CA certificates with Certificate chan?

Help!
1

Hello,

What is the recommended configuration for using CA certificates with Certificate chain?

We tried to use single pem file with both CA and root certificates and used ca-file configuration param:
ca-file /mnt/certificates/ca.pem

and also both ca-verify-file and ca-file configuration param like:
ca-file /mnt/certificates/ca.pem ca-verify-file /mnt/certificates/ca-root.pem

but in both cases root is not loaded. Could someone suggest the correct configuration?

2

Hello,

for me, it isn’t 100% clear, what you are trying to do.
Do you want to check client-certificates, add root-certificates for https-backends or secure your frontends with corresponding ssl-certificates?

best regards,
Markus

3

Hello,

We would like to secure frontends with corresponding ssl-certificates.

Regards,
Paweł

4

Then, ca-file is the wrong location :slight_smile:

You should have a look here => crt

Example from my config:

frontend haproxy-prod-frontend-https
bind *:443 ssl crt /etc/haproxy/ssl/ alpn h2,http/1.1

best regards,
Markus

1 Like