Import Let's Encrypt Certificates to my Netgate for use in HAProxy

daro

I have two servers running with let's encrypt and now I want to add a third server. To give access on port 80 and 443 I have installed HAProxy on my Netgate pfsense+. Instead of running ACME on the fw I would like to import the certs from my servers to use them for the SSL Offloading in HAProxy.
Until now I used ACME to issue the certificates with DNS-Manual mode on my Netgate. With this mode I have to manually renew the certs and adjust the text record every few months on my ISP's domain config.
First I wanted to move on like this, so I tried to change to wildcard certificates. But this broke acme somehow and I wasn't able to get it running again. And since the certificates will last only 45 days from 2028 onwards I thought it would be easier to import them, since the servers do the renewal automatically.

the domains are:
mydomain.tld
www.mydomain.tld
media.mydomain.tld

The certificates are stored on the servers:

sudo ls /etc/letsencrypt/live/www.mydomain.tld (mydomain.tld, media.mydomain.tld)
README cert.pem chain.pem fullchain.pem privkey.pem

What would be the proper way to import and implement these certs into pfsense+ ? I found a few posts to this topic, mostly old ones. Has anybody some good advice?

johnpoz

@daro said in Import Let's Encrypt Certificates to my Netgate for use in HAProxy:

text record every few months on my ISP's domain config.

What would your isp have to do with it? Who is providing the dns for your domains? Do they not have an api to automate the dns method?

You understand you could move your domains dns to some other service - example I host some of my domains dns on cloudflare (free). I use dns to get validate and get new certs via acme on pfsense.

edit: also there a new method coming from acme "DNS-PERSIST-01" this will not require a api where the txt for the dns challenge has to be different every time you renew. But can be added manually, and be perm. This will be much easier method for dns validation, because who you use for dns will not have to have an api, and you will not have to create a token or key that gives acme ability to change records.

https://letsencrypt.org/2025/12/02/from-90-to-45#making-automation-easier-with-a-new-dns-challenge-type

edit2: btw - your post got me thinking about the upcoming 45 day change - and while sure we have time.. I think 2028 is when it really kicks in on acme.. I just changed the profile to tlsserver, so its pulling 45 days certs and did a renew.. And yup got only 45 day cert.

Validity
Not Before
Sat, 05 Sep 2026 10:11:31 GMT
Not After
Tue, 20 Oct 2026 10:11:30 GMT

I am using wildcard btw as well.

daro

@johnpoz
Thank you @johnpoz !

@johnpoz said in Import Let's Encrypt Certificates to my Netgate for use in HAProxy:

Do they not have an api to automate the dns method?

No, they don't have it and right now I don't want to move to cloudflare or another service.

Meanwhile I was able to reestablish the acme server. I found the issue through enabling Debug Logging under General Settings.

Maybe I will wait until the "DNS-PERSIST-01" automation is available. I didn't know that the issuing of shorter certs will also bring another automation mode.

johnpoz

@daro to be honest I could give 2 shits who host my dns as long as it works for what it to do.. If you said xyz dns provides this that and the other thing - and I needed any of those, and it was free I would jump on them in a heart beat.

I don't really understand loyalty with a dns p;rovider - especially if free ;) I would jump ship in a heart beat if they provided X and I wanted X.

But you do you - but what I am saying is I am doing wild card, and having no issues with the new 45 day certs.. So other then checking on it now and then to make sure its not failing - there is zero to do, I really don't get why you would want to setup some system to let the client updates it cert just to move it to haproxy - when haproxy and then acme client on pfsense can do all of that for you.,

daro

@johnpoz thanks! You're right, I will consider doing a change. In my case it is not about loyalty to a dns sevice.
The reason I made this post was a mix of a broken acme config, which is solved, and some thoughts on the work of recurring adjustments of the text record in my dns entry.

johnpoz

@daro btw thanks for your post - got me looking at haproxy again and why I was only seeing 90 on the ssl test for key exchange. Finally got that sorted out and got me to 100 across the board and A+