# HAProxy SSL Configuration Generator (TLS Termination)

> HAProxy TLS settings: ssl-default-bind ciphers and options, TLS 1.2+ minimum, HSTS, HTTP redirect and the combined PEM file.

Source: https://ssl.sh/tools/tls-config-generator/haproxy/
Last updated: 2026-11-10

Generate HAProxy global TLS defaults and a frontend that terminates HTTPS with HSTS and an HTTP redirect.

The HAProxy preset of the [TLS config generator](https://ssl.sh/tools/tls-config-generator/) writes the `global` TLS defaults and a frontend that terminates HTTPS, redirects HTTP and adds HSTS. Copy it into `haproxy.cfg`, adjust the backend, validate and reload.

## Example: intermediate profile

```text
global
    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
    ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets

frontend www
    mode http
    bind :443 ssl crt /etc/haproxy/certs/example.com.pem alpn h2,http/1.1
    bind :80
    http-request redirect scheme https code 301 unless { ssl_fc }
    http-response set-header Strict-Transport-Security "max-age=63072000; includeSubDomains"
    default_backend app

backend app
    server app1 127.0.0.1:8080
```

## Version notes

- HAProxy 2.4 or newer with OpenSSL 1.1.1+ for TLS 1.3 and `ssl-min-ver`.
- For X25519MLKEM768 add `ssl-default-bind-curves X25519MLKEM768:X25519:prime256v1:secp384r1` (HAProxy 2.8+ linked with OpenSSL 3.5+).
- HAProxy 2.8+ can keep OCSP responses fresh with `ocsp-update on` in a crt-list, useful only for CAs that still run OCSP.

## Validate and reload

```bash
haproxy -c -f /etc/haproxy/haproxy.cfg && sudo systemctl reload haproxy
```

## Common mistakes

- **Key missing from the PEM file**: HAProxy fails with "unable to load SSL private key". Append the key or put it in a `.key` file next to the certificate.
- **Chain order**: leaf first, then intermediates. Get a correct bundle from the [chain builder](https://ssl.sh/tools/chain-builder/).
- **HSTS on HTTP responses**: the header only matters on HTTPS; with the redirect above, plain HTTP never reaches the backend.


## FAQ

**How do I build the combined PEM file?**

Concatenate the full chain and the key: cat fullchain.pem privkey.pem > /etc/haproxy/certs/example.com.pem, then chmod 600 the file. HAProxy also accepts the key in a separate file with the same name plus .key.

**How do I serve several domains?**

Point crt at a directory (crt /etc/haproxy/certs/). HAProxy loads every file and picks the certificate by SNI.

**How do I check which TLS versions are accepted?**

Run the ssl.sh SSL checker against the frontend, or test locally with openssl s_client -connect host:443 -tls1_1; with the intermediate profile the TLS 1.1 handshake must fail.