{"id":18008,"date":"2023-08-13T07:35:50","date_gmt":"2023-08-13T07:35:50","guid":{"rendered":"https:\/\/webhostinggeeks.com\/howto\/?p=18008"},"modified":"2023-07-23T07:44:14","modified_gmt":"2023-07-23T07:44:14","slug":"how-to-configure-haproxy-for-multi-domain-ssl-certificates","status":"publish","type":"post","link":"https:\/\/webhostinggeeks.com\/howto\/how-to-configure-haproxy-for-multi-domain-ssl-certificates\/","title":{"rendered":"How to Configure HAProxy for Multi-Domain SSL Certificates"},"content":{"rendered":"

\"How<\/p>\n

As a server administrator, you may often find yourself dealing with the challenge of managing multiple SSL certificates for different domains on your server<\/a>. This is a common scenario, especially when you are running a multi-domain environment. The traditional approach of assigning a separate IP address for each SSL certificate is not only cumbersome but also not scalable.<\/p>\n

The solution to this problem lies in using a powerful, open-source software like HAProxy<\/a>. HAProxy is a high-performance load balancer<\/a> and proxy server<\/a> that can help you manage multiple SSL certificates for different domains efficiently. It supports Server Name Indication (SNI), a feature of the TLS protocol, which allows the server to present multiple certificates on the same IP address and port number.<\/p>\n

By configuring HAProxy for multi-domain SSL certificates, you can streamline your server management tasks, improve the security of your websites, and provide a better user experience for your visitors. This tutorial will guide you through the process step-by-step.<\/p>\n

Let’s get started.<\/p>\n

Step 1: Install HAProxy<\/h2>\n

The first step in configuring HAProxy for multi-domain SSL certificates is to install HAProxy on your server. You can do this by using the package manager of your operating system. For example, on a Ubuntu server, you would use the following command:<\/p>\n

\r\nsudo apt-get install haproxy\r\n<\/pre>\n
This command will install the latest version of HAProxy available in the Ubuntu repositories.<\/p>\n
Step 2: Generate SSL Certificates<\/h2>\n
Before you can configure HAProxy for multi-domain SSL certificates, you need to have the SSL certificates for your domains. You can obtain these certificates from a trusted Certificate Authority (CA). Once you have the certificates, you need to concatenate the private key, the certificate, and the CA bundle into a single .pem file for each domain. You can do this using the following command:<\/p>\n
\r\ncat private.key domain.crt ca_bundle.crt > domain.pem\r\n<\/pre>\n
Replace ‘private.key’, ‘domain.crt’, and ‘ca_bundle.crt’ with the actual file names of your private key, certificate, and CA bundle, respectively. Repeat this process for each domain.<\/p>\n
Step 3: Configure HAProxy<\/h2>\n
Once you have the .pem files, you can proceed to configure HAProxy. The configuration file for HAProxy is typically located at \/etc\/haproxy\/haproxy.cfg. Open this file in a text editor and add the following lines:<\/p>\n
\r\nfrontend https-in\r\n    bind *:443 ssl crt \/etc\/haproxy\/certs\/\r\n    mode http\r\n    option httplog\r\n    option http-server-close\r\n    option forwardfor\r\n    acl host_domain1 hdr(host) -i domain1.com\r\n    acl host_domain2 hdr(host) -i domain2.com\r\n    use_backend domain1_servers if host_domain1\r\n    use_backend domain2_servers if host_domain2\r\n<\/pre>\n
In this configuration, replace ‘domain1.com’ and ‘domain2.com’ with your actual domain names. The ‘bind’ line tells HAProxy to listen on port 443 (the standard port for HTTPS) and to use the SSL certificates located in the \/etc\/haproxy\/certs\/ directory. The ‘acl’ lines define access control lists (ACLs) that match the host header of incoming HTTP requests against the specified domains. The ‘use_backend’ lines tell HAProxy to route the requests to the appropriate backend servers based on the matched ACL.<\/p>\n
Step 4: Test the Configuration<\/h2>\n
After configuring HAProxy, it’s important to test the configuration to ensure that there are no errors. You can do this by using the following command:<\/p>\n
\r\nhaproxy -c -f \/etc\/haproxy\/haproxy.cfg\r\n<\/pre>\n
If the configuration is correct, this command will output ‘Configuration file is valid’.<\/p>\n
Step 5: Restart HAProxy<\/h2>\n
Finally, after testing the configuration, you need to restart HAProxy for the changes to take effect. You can do this by using the following command:<\/p>\n
\r\nsudo systemctl restart haproxy\r\n<\/pre>\n
After restarting HAProxy, your server should now be able to handle multiple SSL certificates for different domains.<\/p>\n
Commands Mentioned:<\/h2>\n