Why is HAProxy unable to load certificates generated by letsencrypt?

Asked 17/12, 2015 at 11:34 Answered 24/2, 2021 at 23:0

Solved ssl-certificate haproxy lets-encrypt

HAProxy is unable to load .pem files generated by letsencrypt, why is this?

The error I'm seeing is:

parsing [/haproxy.cfg:37] : 'bind :443' : unable to load SSL private key from PEM file '/certs/cert0.pem'.

The contents of the PEM file is:

Intolerant answered 17/12, 2015 at 11:34 Comment(2)

Your PEM file don't contain private key, so the error is expected. – Podolsk 17/12, 2015 at 12:27

@CryptoGuy Thanks, I realized in the meantime, as I looked at which other files letsencrypt generated. – Intolerant 17/12, 2015 at 13:41

The problem is that I was using the fullchain.pem file generated by letsencrypt. Instead, one should concatenate it together with 'privkey.pem' (also generated by letsencrypt) into a single .pem file.

Intolerant answered 17/12, 2015 at 13:41 Comment(3)

In case this answer doesn't solve your problem, you might want to try to remove the passphrase from the private key. It solved the problem for me. To remove the password, try 'openssl rsa -in [PRIVATE_KEY_FILE] -out nopassphrase.key' – Kayseri 18/4, 2016 at 21:33

Actionable, copy and paste friendly command line: cat cert.pem privkey.pem > haproxy_cert.pem – Gladsome 1/3, 2018 at 11:26

Concatenating is the solution, but it needs to be automated, otherwise there is no point in automating renewals. – Psychokinesis 11/7, 2019 at 10:24

I could only fix this by using cert.pem instead of fullchain.pem when concatenating.

cat cert.pem key.pem > haproxy_cert.pem

Bainmarie answered 8/11, 2017 at 13:4 Comment(0)

Taken from https://www.haproxy.com/blog/haproxy-ssl-termination/:

frontend www.mysite.com
bind 10.0.0.3:80
bind 10.0.0.3:443 ssl crt /etc/ssl/certs/mysite.pem
default_backend web_servers

The ssl parameter enables SSL termination for this listener. The crt parameter identifies the location of the PEM-formatted SSL certificate.

This certificate should contain both the public certificate and private key.

To be honest, according with my experience on deploying HA Proxy with TLS/SSL end-to-end with minimum 2 nodes as Backend servers, this statement is somewhat true. In fact, HA Proxy requires fullchain.pem (instead of cert.pem) + privkey.pem as a single file. Not using fullchain.pem will lead to messages on Systemd like unable to load cert or things like that.

In a nutshell, you shall do:

$ cat fullchain.pem privkey.pem > /etc/haproxy/mydomain_certs/mydomain.pem

And not:

$ cat cert.pem privkey.pem > /etc/haproxy/mydomain_certs/mydomain.pem

This artile has a valuable example.

Hifalutin answered 31/12, 2019 at 0:41 Comment(0)

Just adding the issue that I encountered. The cat command generated concatenated the files without a newline between them. I manually inserted a new line (using vim) and it worked.

Also in my case I got three files from the registrar: crt, ca-bundle, and p7b. I just want to add that all I needed was the private key file and the crt file (so ca-bundle and p7b were not used).

Nietzsche answered 24/2, 2021 at 23:0 Comment(0)

Recommended topics

Hot tags