# # Insert at the end: # [ alternate_names ] DNS.1 = acd-lb.domain.de DNS.2 = acd-lb.domain.local DNS.3 = acd-lb # # Insert in this section: # [ v3_ca ] subjectAltName = @alternate_names # # Insert or modify in this section: # [ v3_ca ] keyUsage = digitalSignature, keyEncipherment # # Change or comment in this section: # [ CA_default ] copy_extensions = copy

mkdir /etc/ssl/newkey openssl genrsa -out /etc/ssl/newkey/cert.key 3072 openssl req -new -x509 -key /etc/ssl/newkey/cert.key -sha256 -out /etc/ssl/newkey/cert.pem -days 730   # # AnswerRépondez theaux questions ascomme followssuit (forpar exampleexemple) : # Vous êtes Yousur arele aboutpoint tod'être beinvité askedà tosaisir enterdes informationinformations thatqui willseront beintégrées incorporatedà intovotre yourdemande certificatede requestcertificat. WhatCe you are about to enter is what is called a Distinguished Name or aque vous êtes sur le point d'entrer est ce qu'on appelle un nom distinctif ou un DN. ThereIl are quitey a fewde fieldsnombreux butchamps, youmais canvous leavepouvez someen blanklaisser Forcertains somevides. fieldsPour therecertains willchamps, beil ay defaultaura value,une Ifvaleur you enter '.'par défaut, thesi fieldvous will be left blankentrez ". ----- Nom Countrydu Namepays (code de 2 letter codelettres) [XX]:DE State or Province Name (full name Nom de l'État ou de la province (nom complet) []:Bavaria Nom de Localityla Namelocalité (egpar exemple, cityville) [DefaultVille par Citydéfaut]:Munich Organization NameNom de l'organisation (egpar exemple, companysociété) [Default Company Ltd]:jtel GmbH Organizational Unit Name (egNom de l'unité organisationnelle (par exemple, section) []:IT CommonNom Namecommun (egpar exemple, yourvotre nom nameou orle yournom server's hostnamed'hôte de votre serveur) []:acd-lb.domain.de Email Addressemail []:lewis.graham@jtel.de

openssl x509 -in /etc/ssl/newkey/cert.pem -text -noout # Check if all DNS names are listed with this entry: # X509v3 Subject Alternative Name:

cat /etc/ssl/newkey/cert.key > /etc/ssl/newkey/comb.pem cat /etc/ssl/newkey/cert.pem >> /etc/ssl/newkey/comb.pem cp /etc/ssl/newkey/comb.pem /etc/haproxy/haproxy.pem chmod 400 /etc/haproxy/haproxy.pem

# # Frontend http redirects to https # frontend acdportal_http mode http bind :80 redirect scheme https if !{ ssl_fc } # # Frontend for https with certificate # frontend acdportal_https mode http bind :443 ssl crt /etc/haproxy/haproxy.pem #verify optional ...