Yes. HAProxy can proxy requests to HTTPS backends. Add ssl to each backend server line to make HAProxy open a TLS connection to that server. For a production deployment, add verify required and point HAProxy to a trusted CA bundle with ca-file (or use @system-ca). If the backend chooses its certificate or virtual host by hostname, send Server Name Indication (SNI), commonly with sni req.hdr(Host).
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
This is independent of whether HAProxy also terminates HTTPS from clients. It can decrypt a client-side connection, inspect HTTP, and then create a separate encrypted connection to the backend. The two TLS sessions have separate certificates, trust decisions, and failure modes.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat HTTPS backend support means in HAProxy
In a normal reverse-proxy setup, HAProxy accepts a client connection on a frontend and selects a backend server. Without special options, the connection from HAProxy to that server is plain HTTP or TCP. Adding ssl to the backend server definition changes that second leg to TLS.
HAProxy’s documentation describes the configuration succinctly: “To configure TLS between the load balancer and your backend servers, add the ssl and verify arguments to your server lines in a backend.” The usual HTTPS port is 443, but any port can be used when the service is configured for TLS there.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
HTTPS backend support therefore protects traffic between the proxy and the application server. It is useful when those systems communicate across an untrusted network, when policy requires encryption on every hop, or when the application only listens for HTTPS.
Minimal configuration for an HTTPS backend
The following example uses HTTP mode, round-robin load balancing, certificate verification, and explicit SNI:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
backend webservers
mode http
balance roundrobin
server web1 10.0.0.5:443 ssl verify required ca-file /myca.pem sni req.hdr(Host)
server web2 10.0.0.6:443 ssl verify required ca-file /myca.pem sni req.hdr(Host)Each option has a distinct job:
mode httplets HAProxy parse HTTP requests and headers.balance roundrobindistributes new requests across the listed servers.sslenables TLS for the connection from HAProxy to that server.verify requiredrejects a backend certificate that cannot be validated.ca-file /myca.pemsupplies the CA certificate or chain HAProxy should trust.sni req.hdr(Host)places the incoming HTTPHostvalue in the TLS ClientHello’s SNI extension.
If all backend certificates chain to the operating system’s trusted roots, use ca-file @system-ca where supported by your HAProxy build. A private certificate authority normally requires a dedicated PEM file containing that CA certificate and any necessary intermediates.
How backend certificate verification works
With verify required, HAProxy validates the certificate presented by the backend during the TLS handshake. Validation normally includes the signing chain, validity dates, and the trust store selected by ca-file. The backend must present a chain that leads to a CA in that store; trusting a root alone is not a substitute for sending missing intermediate certificates from the server.
Use a custom CA bundle
A custom ca-file is appropriate for an internal PKI, a private service certificate, or a narrowly controlled trust boundary. Keep the file readable by the HAProxy process, include the required PEM certificates, and reload HAProxy after changing it. Restrict file permissions because the bundle describes which issuers the proxy trusts.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Use the system CA store
ca-file @system-ca delegates trust to the system CA store when that special path is available in the installed version and operating system integration. This reduces manual bundle maintenance, but it also means changes to the host’s trust store can change which backend certificates are accepted.
When verify none is acceptable
verify none encrypts the connection without authenticating the backend certificate. It can be useful during a controlled migration, with a deliberately self-signed certificate, or in a network where identity is guaranteed by another mechanism. It must be an explicit risk decision: an attacker able to intercept the connection could impersonate the backend because HAProxy is not checking the certificate chain.
HAProxy also provides the global setting ssl-server-verify none. A global exception affects more servers than a per-server option, so a narrowly scoped verify none is generally easier to audit and remove. Do not combine an unverified backend with the assumption that the traffic is authenticated merely because it is encrypted.
SNI: why an HTTPS backend may need the hostname
Modern HTTPS infrastructure often hosts several names on one IP address. The server uses the SNI hostname sent during the TLS handshake to select the certificate and, in some implementations, the virtual host. An IP address alone may reach the wrong certificate or default site.
In the example above, sni req.hdr(Host) copies the request’s HTTP Host header into SNI. This is useful when the client request name is also the name expected by the backend certificate. If the incoming request has a port in its Host value, confirm that the resulting value matches the backend’s naming and certificate policy; use a more specific sample or map when the names differ.
Recommended Free Tools
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Automatic SNI in HAProxy 3.3 and newer
HAProxy 3.3 and later automatically derive SNI from the HTTP Host header unless automatic SNI is disabled. Health checks receive automatic SNI as well. This reduces configuration for common HTTP backends, but explicit sni req.hdr(Host) remains a portable and readable choice, especially when configurations must run on older releases or when reviewers need to see the dependency.
Use no-sni-auto to disable automatic SNI for a server when the backend must not receive the request hostname. Use no-check-sni-auto when health checks require different SNI behavior. Those switches should be applied only when the backend’s certificate or routing design calls for it; disabling SNI accidentally can produce certificate or virtual-host failures that look like ordinary TLS errors.
Terminating client HTTPS and re-encrypting to the backend
HAProxy can terminate one TLS session and establish another. A typical frontend might look like this:
frontend https_in
mode http
bind :443 ssl crt /etc/haproxy/certs/site.pem
default_backend webservers
backend webservers
mode http
server web1 10.0.0.5:443 ssl verify required ca-file /myca.pem sni req.hdr(Host)The certificate in crt authenticates HAProxy to clients. The certificate presented by web1 authenticates the backend to HAProxy and is checked against /myca.pem. These certificates do not need to be the same, and renewing one does not renew the other.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11After terminating client TLS, HAProxy can apply HTTP routing, headers, health checks, and load balancing before opening the backend TLS connection. If end-to-end encryption is required, ensure the backend leg uses ssl; a TLS frontend alone does not encrypt the hop from HAProxy to the server.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Mutual TLS to the backend
Some backends require HAProxy to prove its identity with a client certificate as well as verify the server certificate. This is mutual TLS (mTLS). The backend server must be listening for HTTPS and configured to request or require a client certificate signed by a CA it trusts.
An mTLS server definition adds a client certificate and key, commonly through the crt argument, while retaining the normal trust and SNI settings. A representative pattern is:
backend secure_api
mode http
server api1 10.0.0.20:443 ssl verify required ca-file /etc/haproxy/backend-ca.pem
crt /etc/haproxy/client.pem sni req.hdr(Host)The crt file must contain the client certificate and its private key in the format expected by HAProxy. Protect that key, match the certificate’s intended usage, and coordinate trust on the backend. mTLS is separate from ordinary server verification: verify required authenticates the backend to HAProxy, while the client certificate authenticates HAProxy to the backend.
Choosing the right backend TLS settings
| Decision | Recommended choice | When another choice is justified |
|---|---|---|
| TLS verification | verify required |
verify none only for a documented exception such as a self-signed certificate during a controlled transition |
| Trust store | ca-file @system-ca when the host trust store is authoritative |
A dedicated ca-file for private PKI or tightly scoped trust |
| SNI | Explicit sni req.hdr(Host) for portable, visible behavior |
HAProxy 3.3+ automatic Host-derived SNI when defaults are acceptable; disable with no-sni-auto only when required |
| HTTP protocol | HTTP/1.1 or HTTP/2 over TLS according to the backend’s supported configuration | HTTP/3 over QUIC only when its experimental status and version requirements are acceptable |
| Client authentication | No client certificate when the backend only authenticates the server | Add crt for a backend that requires mutual TLS |
HTTP/3 and QUIC backend connections
Ordinary HTTPS backend configuration uses TLS over TCP, generally with HTTP/1.1 or HTTP/2. HAProxy’s HTTP tutorial also documents HTTP/3 over QUIC to a backend using a form such as quic4@host:443 ssl. That feature is marked experimental and is limited to HAProxy 3.3 and newer, so it should not be treated as a drop-in replacement for established TCP-based HTTPS backends.
Before choosing QUIC, verify that the HAProxy package was built with the required support, that the backend actually accepts HTTP/3, and that network policy permits UDP traffic. If any of those conditions is uncertain, use conventional TLS over TCP and confirm the backend’s HTTP version separately.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Configuration procedure
- Confirm the backend endpoint. Record the address, TLS port, expected hostname, certificate issuer, and whether the service requires mTLS. Do not assume that the hostname in the public URL is the hostname expected by an internal service.
- Choose the trust source. Use
@system-cafor an appropriate system trust store or create a CA bundle for the backend’s private PKI. Include intermediates where the backend’s certificate chain requires them. - Add
sslto each server line. Use the backend’s TLS port, commonly443. Apply the same trust and SNI policy to every member that serves the application. - Enable verification. Start with
verify requiredand the selectedca-file. Useverify noneonly when the exception is intentional, documented, and appropriately limited. - Set SNI. Add
sni req.hdr(Host)when the backend uses name-based certificates or virtual hosting. On HAProxy 3.3+, decide whether the automatic behavior is suitable and whether health checks need an override. - Validate and reload. Run your normal HAProxy configuration check before reloading. A syntax-valid configuration can still fail at runtime if the CA file is unreadable, the key is inaccessible, or the backend name does not match its certificate.
- Test the complete path. Send a request through the frontend, inspect the response, and check HAProxy logs for TLS alerts, certificate errors, connection timeouts, and health-check status. Test each backend member individually when possible.
Common failures and targeted fixes
Certificate verification fails
Errors about an unknown issuer usually mean the CA bundle does not contain the signing CA, an intermediate certificate is missing, or HAProxy cannot read the file. Install the correct CA chain, fix ownership and permissions, and reload. Do not immediately switch to verify none; that hides the trust problem rather than solving it.
The certificate is for the wrong name
A backend may present its default certificate when SNI is absent or incorrect. Add or correct sni req.hdr(Host), then ensure the request’s Host value is one of the certificate’s names. If the internal name differs from the client-facing name, configure an appropriate fixed or mapped SNI value instead of forwarding the wrong hostname.
The TLS handshake succeeds but the request reaches the wrong site
This usually indicates a virtual-host mismatch after TLS negotiation. Check both SNI and the HTTP Host header. They can be independent: changing SNI selects the certificate and TLS context, while the HTTP header selects the application route.
Health checks mark a working server down
Health checks can fail when they use a different hostname, path, or SNI expectation from production traffic. In HAProxy 3.3+, automatic SNI also applies to health checks unless no-check-sni-auto is set. Review the check’s TLS name and response condition rather than disabling certificate verification globally.
mTLS is rejected
Confirm that the client PEM contains the correct certificate and private key, that the backend trusts the issuing CA, and that the certificate is valid for client authentication. A valid server certificate does not prove that HAProxy supplied an acceptable client identity.
Quick Recap
Operational checklist
- Every intended backend server line has
ssland the correct TLS port. - Production servers use
verify requiredwith a maintained CA source. - The CA file is readable by HAProxy and contains the required chain.
- SNI behavior is explicit or deliberately relies on HAProxy 3.3+ automatic Host handling.
- Health-check SNI matches the backend’s certificate and virtual-host requirements.
- Any use of
verify none,ssl-server-verify none, or disabled automatic SNI is documented and scoped. - Client-side and backend-side certificates are managed as separate credentials.
- mTLS client keys are protected and rotated independently from server trust bundles.
- QUIC/HTTP/3 is used only with HAProxy 3.3+ and after accepting its experimental status.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
