HAProxy SSL configuration generator

The HAProxy preset of the TLS config generator writes the global TLS defaults and a frontend that terminates HTTPS, redirects HTTP and adds HSTS. Copy it into haproxy.cfg, adjust the backend, validate and reload.

Example: intermediate profile

global
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets

frontend www
    mode http
    bind :443 ssl crt /etc/haproxy/certs/example.com.pem alpn h2,http/1.1
    bind :80
    http-request redirect scheme https code 301 unless { ssl_fc }
    http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains"
    default_backend app

backend app
    server app1 127.0.0.1:8080

Version notes

• HAProxy 2.4 or newer with OpenSSL 1.1.1+ for TLS 1.3 and ssl-min-ver.
• For X25519MLKEM768 add ssl-default-bind-curves X25519MLKEM768:X25519:prime256v1:secp384r1 (HAProxy 2.8+ linked with OpenSSL 3.5+).
• HAProxy 2.8+ can keep OCSP responses fresh with ocsp-update on in a crt-list, useful only for CAs that still run OCSP.

Validate and reload

haproxy -c -f /etc/haproxy/haproxy.cfg && sudo systemctl reload haproxy

Common mistakes

• Key missing from the PEM file: HAProxy fails with "unable to load SSL private key". Append the key or put it in a .key file next to the certificate.
• Chain order: leaf first, then intermediates. Get a correct bundle from the chain builder.
• HSTS on HTTP responses: the header only matters on HTTPS; with the redirect above, plain HTTP never reaches the backend.