I am attempting to utilise certificate bundles so we can have multi-type certs in haproxy however this seems non-functional.
I have a two cert bundles as follows (only testing with RSA certs at the moment): /etc/haproxy/ssl # ls -l /etc/haproxy/ssl/ total 16 -rw-r--r-- 1 root root 1184 Dec 20 01:39 test1.pem.issuer.rsa -rw-r--r-- 1 root root 2888 Dec 20 01:26 test1.pem.rsa -rw-r--r-- 1 root root 1184 Dec 20 01:40 test2.pem.issuer.rsa -rw-r--r-- 1 root root 2888 Dec 20 01:30 test2.pem.rsa With the following config of my two front-ends: frontend test1 bind *:5000 ssl crt test1.pem default_backend app1 frontend test2 bind *:5001 ssl crt test2.pem default_backend app2 But this then fails: /etc/haproxy/ssl # haproxy -f /etc/haproxy/haproxy.cfg -c [ALERT] 353/014339 (59) : parsing [/etc/haproxy/haproxy.cfg:34] : 'bind *:5000' : unable to stat SSL certificate from fi le '/etc/haproxy/ssl/test1.pem' : No such file or directory. [ALERT] 353/014339 (59) : parsing [/etc/haproxy/haproxy.cfg:38] : 'bind *:5001' : unable to stat SSL certificate from fi le '/etc/haproxy/ssl/test2.pem' : No such file or directory. [ALERT] 353/014339 (59) : Error(s) found in configuration file : /etc/haproxy/haproxy.cfg [ALERT] 353/014339 (59) : Fatal errors found in configuration. Build Options: HA-Proxy version 1.7.9 2017/08/18 Copyright 2000-2017 Willy Tarreau <wi...@haproxy.org> Build options : TARGET = linux2628 CPU = generic CC = gcc CFLAGS = -Os -fomit-frame-pointer OPTIONS = USE_ZLIB=1 USE_OPENSSL=1 USE_LUA=1 USE_PCRE=1 Default settings : maxconn = 2000, bufsize = 16384, maxrewrite = 1024, maxpollevents = 200 Encrypted password support via crypt(3): yes Built with zlib version : 1.2.11 Running on zlib version : 1.2.11 Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip") Built with OpenSSL version : LibreSSL 2.6.3 Running on OpenSSL version : LibreSSL 2.6.3 OpenSSL library supports TLS extensions : yes OpenSSL library supports SNI : yes OpenSSL library supports prefer-server-ciphers : yes Built with PCRE version : 8.41 2017-07-05 Running on PCRE version : 8.41 2017-07-05 PCRE library supports JIT : no (USE_PCRE_JIT not set) Built with Lua version : Lua 5.3.4 Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND Available polling systems : epoll : pref=300, test result OK poll : pref=200, test result OK select : pref=150, test result OK Total: 3 (3 usable), will use epoll. Available filters : [COMP] compression [TRACE] trace [SPOE] spoe -- Andrew Heberle