{"type":"doc","content":[{"type":"paragraph","content":[{"text":"This KB guide focuses on using ","type":"text"},{"text":"OpenSSL","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.openssl.org/"}}]},{"text":" and ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"link","attrs":{"href":"https://testssl.sh/"}}]},{"text":" to validate SSL/TLS certificates, ensuring they are configured correctly, include a complete certificate chain, and are trusted. It covers testing certificates both locally and on HAProxy servers.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"6"},"outline":{"value":"false"},"style":{"value":"none"},"type":{"value":"list"},"printable":{"value":"true"}},"macroMetadata":{"macroId":{"value":"2e50dab6-d6f1-4fd4-8c54-0afdd2a7fc45"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"f3774158-ed61-458f-9132-a946ef04604e"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Prerequisites","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Install ","type":"text"},{"text":"OpenSSL","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensure OpenSSL is installed on your system. Most Linux distributions include it by default:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl version","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Install ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Clone the repository from GitHub","type":"text"}]},{"type":"codeBlock","content":[{"text":"git clone --depth 1 https://github.com/drwetter/testssl.sh.git\ncd testssl.sh\nchmod +x testssl.sh","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HAProxy Configuration (if applicable):","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Confirm HAProxy is running with SSL/TLS enabled.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify the SSL port (default: ","type":"text"},{"text":"443","type":"text","marks":[{"type":"code"}]},{"text":") is exposed for testing.","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Validating a PEM Certificate Locally","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Check PEM File Syntax","type":"text"}]},{"type":"paragraph","content":[{"text":"Use OpenSSL to verify certificate file’s syntax:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl x509 -in .pem -noout -text","type":"text"}]},{"type":"paragraph","content":[{"text":"This command:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verifies the certificate’s syntax.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Displays details such s issuer, subject, validity period, and extensions.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"To check the entire certificate chain (server + intermediate certificates), use:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl crl2pkcs7 -nocrl -certfile .pem | openssl pkcs7 -print_certs -noout","type":"text"}]},{"type":"paragraph","content":[{"text":"This breaks down and lists all certificates in the chain.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Verify Certificate Matches Private Key","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure the certificate and private key correspond:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl x509 -noout -modulus -in .pem | openssl md5\nopenssl rsa -noout -modulus -in .key | openssl md5","type":"text"}]},{"type":"paragraph","content":[{"text":"The outputs must match, the certificate and key are correctly paired.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Check Certificate Expiry Date","type":"text"}]},{"type":"paragraph","content":[{"text":"Confirm the certificate is within its validity period:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl x509 -in .pem -noout -dates","type":"text"}]},{"type":"paragraph","content":[{"text":"This displays the ","type":"text"},{"text":"notBefore","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"notAfter","type":"text","marks":[{"type":"code"}]},{"text":" dates.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"4. Verify Intermediate Certificate is Trusted","type":"text"}]},{"type":"paragraph","content":[{"text":"Use the following command to confirm that the intermediate certificate is signed by a trusted root:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl verify -CAfile .pem","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Test with OpenSSL Local Server","type":"text"}]},{"type":"paragraph","content":[{"text":"You can test a PEM certificate directly by hosting it temporarily with a test server like ","type":"text"},{"text":"openssl","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Start a Local Test Server","type":"text"}]},{"type":"paragraph","content":[{"text":"Use OpenSSL to serve the PEM certificate on a local port:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl s_server -accept 4433 -cert .pem -key .key","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":".pem","type":"text","marks":[{"type":"code"}]},{"text":" with your PEM file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":".key","type":"text","marks":[{"type":"code"}]},{"text":" with the corresponding private key.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Run ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"code"}]},{"text":" Against the Local Test Server","type":"text"}]},{"type":"paragraph","content":[{"text":"With the test server running (","type":"text"},{"text":"openssl","type":"text","marks":[{"type":"code"}]},{"text":"), validate the certificate using ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh --certs https://127.0.0.1:4433","type":"text"}]},{"type":"paragraph","content":[{"text":"This checks:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate validity.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Complete certificate chain.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Expiration and trustworthiness.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Using ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"code"}]},{"text":" for HAProxy SSL/TLS Validation","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Basic SSL/TLS Validation","type":"text"}]},{"type":"paragraph","content":[{"text":"Check the HAProxy SSL/TLS configuration:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh https://:","type":"text"}]},{"type":"paragraph","content":[{"text":"This checks:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Supported protocols.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Available ciphers.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate properties.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Certificate Chain Validation:","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure the complete certificate chain is present:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh --certs https://:","type":"text"}]},{"type":"paragraph","content":[{"text":"This identifies:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Missing intermediate certificates.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Trust issues in the chain.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Testing Specific Front-ends","type":"text"}]},{"type":"paragraph","content":[{"text":"If HAProxy has multiple front-ends on different ports:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh https://:","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh https://haproxy.example.com:9091","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common Issues and Solutions","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Incomplete Certificate Chain","type":"text"}]},{"type":"paragraph","content":[{"text":"HAProxy must be configured to provide the full certificate chain. Ensure the ","type":"text"},{"text":"PEM","type":"text","marks":[{"type":"code"}]},{"text":" file includes:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The server certificate.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Intermediate certificates.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"You can concatenate certificates into a single ","type":"text"},{"text":"PEM","type":"text","marks":[{"type":"code"}]},{"text":" file as follows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"cat server.crt intermediate.crt > fullchain.pem","type":"text"}]},{"type":"paragraph","content":[{"text":"Update your HAProxy configuration to use the ","type":"text"},{"text":"fullchain.pem","type":"text","marks":[{"type":"code"}]},{"text":":","type":"text"}]},{"type":"codeBlock","content":[{"text":"frontend www-https\n bind *:443 ssl crt-list /etc/haproxy/ssl/fullchain.pem\n reqadd X-Forwarded-Proto:\\ https\n reqadd X-Forwarded-Port:\\ 443\n default_backend www-backend-scsp","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Untrusted Certificate","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify the root CA is trusted on client systems.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Cross-check using online tools like SSL Labs.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Incorrect Certificate Deployment","type":"text"}]},{"type":"paragraph","content":[{"text":"Verify the PEM file and private key:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl x509 -in /etc/haproxy/fullchain.pem -text -noout\nopenssl rsa -in /etc/haproxy/server.key -check","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"4. SSL Configuration Errors","type":"text"}]},{"type":"paragraph","content":[{"text":"Validate HAProxy configuration:","type":"text"}]},{"type":"codeBlock","content":[{"text":"haproxy -c -f /etc/haproxy/haproxy.cfg","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure the ","type":"text"},{"text":"bind","type":"text","marks":[{"type":"code"}]},{"text":" directive specifics correct SSL/TLS options.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Advanced Testing with ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"1. Check for Expiring Certificates","type":"text"}]},{"type":"paragraph","content":[{"text":"Run the following to get alerts about Certificates nearing expiration:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh --certs --warnings https://","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"2. Analyze Protocol and Cipher Support","type":"text"}]},{"type":"paragraph","content":[{"text":"HAProxy often uses a specific SSL/TLS configuration. Test supported protocols and ciphers:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh --protocols https://\n./testssl.sh --ciphers https://","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"3. Generate Reports for Documentation","type":"text"}]},{"type":"paragraph","content":[{"text":"Export results for documentation or reporting:","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh --jsonfile haproxy_test.json https://\n./testssl.sh --htmlfile haproxy_test.html https://","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Troubleshooting HAProxy SSL Issues","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Incomplete Certificate Chain","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensure intermediate certificates are included in the ","type":"text"},{"text":"PEM","type":"text","marks":[{"type":"code"}]},{"text":" file.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use ","type":"text"},{"text":"testssl.sh --certs","type":"text","marks":[{"type":"code"}]},{"text":" to identify missing certificates.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Certificate Not Trusted","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Verify the root CA is trusted on client systems.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use online tools like ","type":"text"},{"text":"SSL Labs","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.ssllabs.com/"}}]},{"text":" to cross-check.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"SSL Configuration Errors","type":"text"}]},{"type":"paragraph","content":[{"text":"Check the HAProxy configuration file for syntax issues:","type":"text"}]},{"type":"codeBlock","content":[{"text":"haproxy -c -f /etc/haproxy/haproxy.cfg","type":"text"}]},{"type":"paragraph","content":[{"text":"Ensure bind directives correctly specify SSL options.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Incorrect Certificate Deployment","type":"text"}]},{"type":"paragraph","content":[{"text":"Verify the certificate file and key are correct:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl x509 -in /etc/haproxy/fullchain.pem -text -noout\nopenssl rsa -in /etc/haproxy/server.key -check","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Example: Validating HAProxy SSL Certificate","type":"text"}]},{"type":"codeBlock","content":[{"text":"./testssl.sh --certs https://haproxy.example.com:443","type":"text"}]},{"type":"paragraph","content":[{"text":"Expected Output:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate is valid: Yes","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Chain issues: None","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Expiration: Valid until YYYY-MM-DD","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Protocols and ciphers: Secure configurations","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Summary","type":"text"}]},{"type":"paragraph","content":[{"text":"By following these instructions, you can effectively validate SSL/TLS certificates using ","type":"text"},{"text":"OpenSSL","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"testssl.sh","type":"text","marks":[{"type":"code"}]},{"text":". These tools help ensure certificates are valid, chains are complete, and configurations are secure. Regular testing maintains a strong SSL/TLS posture for services like HAProxy.","type":"text"}]}],"version":1}

Browser not supported