# use Certbot to automatically generate and renew Let's Encrypt certificates for HAproxy

## Install

install haproxy & certbot:
```
apt install haproxy certbot
```

## Configure HAproxy HTTP

we need to configure haproxy to reroute Let's Encrypt requests to the certbot server. The beginning of your web frontend should look like:
```
frontend www
        bind *:80
		option forwardfor
		
        # Reroute certbot requests to certbot
        use_backend certbot if { path_beg /.well-known/acme-challenge/ }
		
		...
```
and also add a backend:
```
backend certbot
        server certbot localhost:8888
```

## Configure Certbot

We also want to configure Certbot so we can easily use it for creating/renewing certificates for HAproxy. Edit the file `/etc/letsencrypt/cli.ini` and add the lines:
```
standalone
# tls-sni challenge is deprecated
preferred-challenges = http
http-01-port = 8888
deploy-hook = /etc/letsencrypt/deploy-hook.sh
```
We also need to add the deploy hook script that we referenced in the config file, at `/etc/letsencrypt/deploy-hook.sh`. The contents of the script should be:
```
#!/bin/sh

mkdir -p /etc/haproxy/certs
base=$(basename $RENEWED_LINEAGE)
cat $RENEWED_LINEAGE/fullchain.pem $RENEWED_LINEAGE/privkey.pem > /etc/haproxy/certs/$base.pem
#etckeeper commit "got new Let's Encrypt certificate for $base"
service haproxy reload
```
(Uncomment the `etckeeper` line if you are using etckeeper to store your configuration). And don't forget to make the script executable:
```
chmod +x /etc/letsencrypt/deploy-hook.sh
```

With this configuration, you should be able to run certbot to obtain a certificate. The cron job that is automatically set up when you install certbot will also work correctly with this configuration.

## Get Certificate

Run Certbot to get a certificate:
```
certbot certonly
```
After successfully acquiring a certificate, the deploy hook will automatically put the combined certificate in `/etc/haproxy/certs/` for you.

## Configure HAproxy HTTPs

Now that you have HTTPs working, you can configure HAproxy for HTTPs. The beginning of your web frontend should now look like:
```
frontend www
        bind *:80
        bind *:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1
        option forwardfor
        http-request set-header X-Forwarded-Proto https if { ssl_fc }

        # Reroute letsencrypt requests to certbot
        use_backend certbot if { path_beg /.well-known/acme-challenge/ }

        # Reroute HTTP to HTTPs
        http-request redirect scheme https if !{ ssl_fc }
		
		...
```