Configure HAProxy Certificate

To have the HAProxy allow forward requests to your applications, you must provide it with a TLS Certificate. This certificate is used for incoming/outgoing traffic from the outside of the Kubernetes or OpenShift cluster to your applications. HAProxy performs TLS offloading.

Generate self-signed certificate

It is recommended that you use a properly signed certificate for HAProxy. However, it is also possible to create and use a self-signed certificate, for example, for staging or testing environment.

Creation of that certificate can be achieved using the following commands for OpenSSL:

# Creation of a private key and associated certificate
openssl req -x509 -newkey rsa:2048 -keyout my-key.pem -out my-cert.pem -days 365 -subj "/CN=my-cert" -nodes

This provides you with a key and cert file that can be used in the next step, creation of the certificate to your deployment.

Use certificate

Create secret

To have your deployment and HAProxy to use the certificate, you must store it in the Kubernetes or OpenShift cluster as a secret.

The secret can be created using the following commands:

Note

The secret name can be chosen by you and must be referenced in the next configuration step (the following example uses dx-tls-cert). The namespace is the Kubernetes namespace where you want to deploy HCL Digital Experience 9.5 to (the example uses digital-experience).

# Create secret with the name "dx-tls-cert"
# Secret will be created in the namespace "digital-experience"
# You can either reference the cert and key file created before, or a proper signed certificate e.g. from your CA
kubectl create secret tls dx-tls-cert --cert=my-cert.pem --key=my-key.pem -n digital-experience 

Configure secret in deployment

You need to make sure that the reference to the secret is set up correctly in your custom-values.yaml file. Otherwise, HAProxy cannot answer HTTPS requests due to a missing certificate.

You can set the name of the certificate used with the following syntax, the default value is dx-tls-cert:

# Networking specific configuration
networking:
 # TLS Certificate secret used for HAProxy
 tlsCertSecret: "dx-tls-cert"

Note

Verify you have entered the correct name.