https://oxcrag.net/2017/04/30/wordpress-behind-haproxy-with-tls-termination/TLS termination configuration
The problem with terminating TLS traffic before the web server, is that any good web application should be able to recognize that the client is coming from an insecure connection. Luckily, we can use HAProxy to tell WordPress that the connection was good up until the load balancer and to trust it the rest of the way. Be aware that this is an extremely bad idea if there is any way to reach the web server other than via your HAProxy:
/usr/share/wordpress/wp-config.php:
[...]
/** Make sure WordPress understands it's behind an SSL terminator */
define('FORCE_SSL_ADMIN', true);
define('FORCE_SSL_LOGIN', true);
if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
$_SERVER['HTTPS']='on';
[...]
/etc/haproxy/haproxy.cfg:
[...]
frontend web-https
option http-server-close
http-request set-header X-Forwarded-Proto https if { ssl_fc }
[...]
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# modern configuration
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
defaults
log global
mode http
option httplog
option dontlognull
option forwardfor
option http-server-close
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend stats
bind *:9000
mode http
log global
maxconn 10
stats enable
stats refresh 10s
stats show-node
stats auth nguyen:Anne1021
stats uri /
frontend www-http
bind *:80
bind *:443 ssl crt /etc/haproxy/ssl/
http-request set-header X-Forwarded-Proto https if { ssl_fc }
# letsencryp validation path for cert request
acl letsencrypt-acl path_beg /.well-known/acme-challenge/
acl wp_site hdr(host) -i bebubi.com
acl wp_site hdr(host) -i www.bebubi.com
acl wp_site hdr(host) -i wp.bebubi.com
acl wp_site hdr(host) -i bibube.com
acl wp_site hdr(host) -i www.bibube.com
acl wp_site hdr(host) -i wp.bibube.com
acl nc_site hdr(host) -i nc.bibube.com
acl nc_site hdr(host) -i nc.bebubi.com
use_backend letsencrypt-backend if letsencrypt-acl
use_backend wp-backend if wp_site
use_backend nc-backend if nc_site
backend letsencrypt-backend
server letsencrypt 127.0.0.1:8888
backend wp-backend
server wp 192.168.0.201:80
backend nc-backend
server nc 192.168.0.200:443 check ssl verify none
Installing Let’s Encrypt Client
sudo add-apt-repository ppa:certbot/certbot sudo apt-get update sudo apt-get install certbot
Obtaining a Certificate
Verify Port 80 is Open Then sudo certbot certonly --standalone --preferred-challenges http --http-01-port 80 -d bibube.com -d wp.bibube.com -d nc.bibube.com -d www.bibube.com sudo certbot certonly --standalone --preferred-challenges http --http-01-port 80 -d bebubi.com -d wp.bebubi.com -d nc.bebubi.com -d www.bebubi.com
Automated renewal script
root@pi-haproxy:~# cat renewCerts #!/bin/bash certbot renew --force-renewal --standalone --preferred-challenges http --http-01-address 127.0.0.1:8888 # Loop through all Let's Encrypt certificates for CERTIFICATE in `find /etc/letsencrypt/live/* -type d`; do CERTIFICATE=`basename $CERTIFICATE` # Combine certificate and private key to single file cat /etc/letsencrypt/live/$CERTIFICATE/fullchain.pem /etc/letsencrypt/live/$CERTIFICATE/privkey.pem > /etc/haproxy/ssl/$CERTIFICATE.pem done systemctl reload haproxy.service