SSL Toolkit Logo
Tools Features Compare FAQ Login
HA

PEM/PFX to HAProxy Config

Convert your SSL certificate to a production-ready HAProxy frontend configuration.

About

This tool converts your SSL certificate (PEM format or PFX/PKCS12) into a production-ready HAProxy frontend configuration. It follows the Mozilla Server Side TLS guidelines — the same standards used by SSL Labs to grade servers.

HAProxy uses a combined PEM file containing both the certificate and private key. The generated config includes bind directives, SSL protocols, cipher suites, OCSP stapling, HSTS headers, and HTTP to HTTPS redirect.

How to Use

  1. 1Upload your PEM certificate file or paste the data. You can also upload a PFX/PKCS12 file.
  2. 2If using PFX, enter the password in the PFX Password field.
  3. 3Select a security profile: Modern (TLS 1.3), Intermediate (TLS 1.2 + 1.3), or Old (legacy).
  4. 4Toggle features: HSTS, OCSP Stapling, HTTP to HTTPS redirect, HTTP/2.
  5. 5Click Generate HAProxy Config and copy or download the configuration.

Use Cases

✓New HAProxy server — Generate SSL config when deploying a new HAProxy load balancer.
✓Certificate renewal — Update HAProxy config after renewing your SSL certificate.
✓SSL Labs A+ — Generate configs that earn an A+ grade on SSL Labs.
✓HSTS preload — Get HAProxy config with HSTS headers ready for preload submission.
✓PFX migration — Convert PFX certificate from IIS/Windows to HAProxy format.
✓Security hardening — Apply Mozilla recommended cipher suites to HAProxy.

Tips & Best Practices

  • •Use the Intermediate profile for most sites. Only use Modern if all clients support TLS 1.3.
  • •HAProxy requires a combined PEM file with cert + key concatenated. Use this tool to generate it.
  • •Enable ssl-server-verify for backend health checks over TLS.
  • •Reload HAProxy after config changes: haproxy -sf $(cat /var/run/haproxy.pid) -f /etc/haproxy/haproxy.cfg
  • •Test config before reload: haproxy -c -f /etc/haproxy/haproxy.cfg
  • •Place cert and key in /etc/haproxy/certs/ with restrictive permissions.

HAProxy SSL Directives Explained

ssl

Enables SSL/TLS on the bind line. Used with crt parameter to specify the certificate file.

crt

Path to the combined PEM file (cert + key). The file must contain both in one file.

ssl-min-ver / ssl-max-ver

Specifies min and max TLS versions. Modern: ssl-min-ver TLSv1.3. Intermediate: ssl-min-ver TLSv1.2.

ssl-default-bind-ciphers / ssl-default-bind-options

Global cipher suite and options. Set in the global section for all frontends.

Frequently Asked Questions

What files do I need for HAProxy SSL?

HAProxy requires a combined PEM file containing both the certificate and private key concatenated together. Use this tool to generate the combined file from your PEM or PFX certificate.

How do I create a combined PEM for HAProxy?

Concatenate the certificate and private key: cat cert.pem key.pem > combined.pem. Or simply use this tool — it generates the combined file automatically.

How do I reload HAProxy after changing SSL config?

Run haproxy -c to validate the config, then haproxy -sf $(cat /var/run/haproxy.pid) -f /etc/haproxy/haproxy.cfg to gracefully reload.

Related Tools

All Servers

Configs for all 6 servers
Ng

PEM to Nginx

Nginx server block config
Ap

PEM to Apache

Apache VirtualHost config

SSL Checker

Verify your HAProxy config

SSL Converter

Convert cert formats

Cipher Ranking

Rank cipher suites