HAProxy

CertGuardian can install a certificate on HAProxy using the SSH Hook. Because HAProxy uses a single PEM file containing the certificate, private key, and certificate chain, the SSH Hook configuration requires a few additional settings.

1. Identify the HAProxy certificate file

First, identify the bundled certificate file currently used by HAProxy. In this example, the file is:

/etc/ssl/cert_haproxy.pem

2. Configure the certificate destinations

CertGuardian installs in separate files the private key, certificate, and intermediate certificate (chain).

These files should be located in the same directory as the HAProxy certificate, but they must have different filenames. They are dedicated to CertGuardian and must not be used by HAProxy.

Configure the following destination paths in the SSH Hook:

• Private key: /etc/ssl/privkey_certguardian.pem
• Certificate: /etc/ssl/cert_certguardian.pem
• Intermediate certificate (chain): /etc/ssl/chain_certguardian.pem

These files should not exist in the directory. CertGuardian will create and use them to store the individual certificate components before they are combined into the PEM file used by HAProxy.

3. Configure the reload command

The "Reload command" must perform three operations. Create a backup of the current certificate of HAProxy

cp /etc/ssl/cert_haproxy.pem /etc/ssl/cert_haproxy.pem.bak

Combine the certificate components The certificate, private key, and intermediate certificate must be concatenated into the PEM file used by HAProxy:

cat /etc/ssl/cert_certguardian.pem /etc/ssl/privkey_certguardian.pem /etc/ssl/chain_certguardian.pem > /etc/ssl/cert_haproxy.pem

Reload HAProxy

systemctl reload haproxy

Combine these commands using && to run it as only one command.

The resulting Reload command is:

cp /etc/ssl/cert_haproxy.pem /etc/ssl/cert_haproxy.pem.bak && cat /etc/ssl/cert_certguardian.pem /etc/ssl/privkey_certguardian.pem /etc/ssl/chain_certguardian.pem > /etc/ssl/cert_haproxy.pem && systemctl reload haproxy