![](https://matthewdavis.io/wp-content/uploads/2018/10/Blog-image-Lets-Encrypt.png)
Setup HAproxy and use LetsEncrypt
We’re going to use HAproxy to perform SSL termination which will then “reverse proxy” to our web server using a (free) SSL Certificate from LetsEncrypt.
Installation
CentOS/RHEL
Installing HAproxy + certbot:
$ sudo yum install -y epel-release
$ sudo yum install -y haproxy certbot
Opening the firewall:
$ sudo firewall-cmd --permanent --add-port=80/tcp
$ sudo firewall-cmd --permanent --add-port=443/tcp
$ sudo firewall-cmd --reload
Debian/Ubuntu
Installing HAproxy + certbot:
$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install -y haproxy certbot
Opening the firewall:
$ sudo ufw allow http
$ sudo ufw allow https
Generating SSL Certificate using certbot
We’ll use the certbot command line tool to generate our ssl certificate for us. certbot is a command line interface to Let’sEncrypt.org’s API service. Generate certificate:
$ certbot certonly -d mydomain.com -d www.mydomain.com
Once our certificate has been generated it will live under:
$ ls -la /etc/letsencrypt/live/mydomain.com
Configuring HAproxy
/etc/haproxy/haproxy.cfg
frontend
bind *:80
bind *:443 ssl crt /etc/letsencrypt/live/yourdomain.com/all.pem
use_backend www
backend www
server node1 127.0.0.1:81 check # we will set nginx to listen on port 81