Lab: SSL termination and ACL routing

What you will learn in this TP

• Terminate TLS and force HTTPS
• Route with ACLs
• Reload without downtime

HTTPS and ACLs #

What you will learn in this section

• Terminate TLS and force HTTPS
• Route with ACLs
• Reload without downtime

Context. A site must move to HTTPS, redirect legacy HTTP and separate API traffic from the rest, while restricting access to an admin interface. HAProxy terminates TLS and applies ACLs to route and filter.

Prerequisites: Previous lab, OpenSSL  ·  Estimated time: 45 min

A self-signed certificate and routing rules.

1. 1. Generate a certificate

   Why? HAProxy expects a PEM file with certificate and key: generating it yourself makes the lab self-contained, with no external authority.

   Create the PEM file HAProxy expects.

2. 2. HTTPS frontend and redirect

   Why? TLS termination offloads encryption from servers and centralises certificates; redirect and HSTS enforce secure use.

   Listen on 443, redirect 80 to HTTPS and add HSTS.

3. 3. Test the routing

   Why? Testing each path and the certificate checks the ACLs route correctly and the client sees what you expect.

   Call / and /api and check the certificate.

4. 4. Validate and reload without downtime

   Why? Validating before reloading and using a reload signal avoids interrupting ongoing connections.

   Change a rule then reload cleanly.

Difficulty level : ●●●○○ (3/5)