HA Proxy no Certificate Option

4o4rh

I am trying to pass haos.duckdns.org to my internal server.
getting the below error with curl -v -k -H "Host: xxxx.duckdns.org" https://xxxxxx/auth/

ALPN: curl offers h2,http/1.1
TLSv1.3 (OUT), TLS handshake, Client hello (1):
SSL Trust: peer verification disabled
TLS connect error: error:0A00010B:SSL routines::wrong version number
closing connection #0
curl: (35) TLS connect error: error:0A00010B:SSL routines::wrong version number

Grok tells me
Go to your Frontend (the one for external access) and make sure it looks like this:
Name: something like HTTPS
Listen address: your WAN IP (or *)
Port: 443
Type: HTTP/HTTPS (Offloading)
SSL Certificate: select your Let's Encrypt cert for eapehaos.duckdns.org
Advanced → SSL Offloading enabled

There is no option to select the acme certificate or any certificate for that matter.

4o4rh

interestingly, in Certificate Manager
haos shows only in use by acme where as
netbird shows in use by both acme and ha proxy

problem seems to be there are no certificates in https_frontend.crt_list
but there seems to be no menu to add them

giuliafw70

That error usually means TLS is not actually being spoken on the place you are testing, or the frontend/backend mode is mixed. I would first check that the HAProxy frontend is really set to SSL offloading on 443; the certificate picker only appears for that kind of frontend, not for a plain HTTP one. Also make sure the ACME cert is installed in System > Cert. Manager as a normal cert with its key, not only present in the ACME package state. After that, save/reopen the frontend and it should be available in the cert list.

4o4rh

@giuliafw70 I made some progress from the certificate setup

SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=xxxx.duckdns.org
*   start date: Jun 24 08:41:25 2026 GMT
*   expire date: Sep 22 08:41:24 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YR1
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
* OpenSSL verify result: 14
*  SSL certificate verification failed, continuing anyway!
* Established connection to 5.146.xxxx (5.146.xxxxx port 443) from 5.146.xxxxx port 15240 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://5.146.xxxxx/auth/token
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: xxxx.duckdns.org]
* [HTTP/2] [1] [:path: /auth/token]
* [HTTP/2] [1] [user-agent: curl/8.20.0]
* [HTTP/2] [1] [accept: */*]
> GET /auth/token HTTP/2
> Host: xxxx.duckdns.org
> User-Agent: curl/8.20.0
> Accept: */*

but it can't validate against the certificate authority because the letscrypt cert points to duckdns.org
how do i over come this?

4o4rh

last issue was Dynamic DNS problem. I wasn't updating the domains properly