IT-Tech blog about different tried and tested solutions based on vmware, microsoft, linux and more tips and tricks

How to Export Certificates from HAProxy

Welcome to my HAProxy Server series. In this sub-section I will show how I exported the certificates from my HAProxy server to be used with my VMware UAG’s. I will first renew the existing certificate and then export the certificates to used on the HAProxy serving the desktop.frelab.net URL. My Letsencrypt certificate is as shown below:

Step 1 – View Certificate Details

To view the certificate details and path, I run the following command:

Shell
sudo certbot certificates -d desktop.frelab.net

Step 2 – Request a New Certificate

Now I will request a new certificate for my HAProxy.

Shell
sudo certbot -d desktop.frelab.net --manual --preferred-challenges dns certonly

Step 3 – Merge Certificate Files

Once renewal is done, I merge the two files into my certificate “/etc/ssl/desktop.frelab.net/desktop.frelab.net.pem“

Shell
sudo cat /etc/letsencrypt/live/desktop.frelab.net/fullchain.pem \
  /etc/letsencrypt/live/desktop.frelab.net/privkey.pem \
| sudo tee /etc/ssl/desktop.frelab.net/desktop.frelab.net.pem

Step 4 – Verify and Restart HAProxy

I verify the HAProxy config and restart the HAProxy service

Shell
haproxy -c -f /etc/haproxy/haproxy.cfg
sudo service haproxy restart

Step 5 – Package the Certificate

Next, I create a tar-file containing the folder with the certificate

Shell
sudo tar -chvzf certs.tar.gz /etc/letsencrypt/live/desktop.frelab.net

Step 6 – Transfer and Extract the Files

I can now connect using winscp and transfer the tar-file as needed. Once done I extract the files

Step 7 – Upload to the VMware UAGs

Finally, I upload private key and certificate chain to my VMware Unified Access Gateways

Step 8 – Reboot and Verify

Finally I do a controlled reboot of my UAG’s and verify the certificate status and expiry date.

Step-by-Step HAProxy Installation Guide

Disclaimer: Every tips/tricks/posting I have published here, is tried and tested in different it-solutions. It is not guaranteed to work everywhere, but is meant as a tip for other users out there. Remember, Google is your friend and don’t be afraid to steal with pride! Feel free to comment below as needed.