Reload HAProxy after SSL certificate renewal

Successful reload haproxy ssl certificate workflows run config test, soft reload, and external serial verification—renewal on disk alone does not update what HAProxy workers present on bind lines.

HAProxy mmap certificate material when processes start or reload. Certbot, acme.sh, or vendor scripts may update PEM paths referenced in crt directives while the running master still serves the old chain until you signal it.

Teams use HAProxy for TCP and HTTP TLS, often with multiple frontends sharing defaults. This guide covers validate-reload-confirm steps and hook placement. For locating PEM paths before renewal, align frontends with your inventory runbooks for How to fix an expired SSL certificate.

Pair with Certbot deploy and reload hooks when certbot renews on the same host as HAProxy.

What to check

List each bind line using ssl crt or crt-list files. Note whether you use PEM directories, .pem bundles, or SNI crt-list maps per domain.

Compare openssl serial on the public VIP with serial read from the PEM path in configuration. Mismatch confirms reload omission or wrong crt-list entry.

Ensure haproxy -c config test passes; failed checks block reload scripts silently in some cron wrappers. Identify all HAProxy instances in active-active pairs receiving traffic.

Verify renewed files include the full chain HAProxy expects. Missing intermediate bundles sometimes follow reload but fail trust; still capture serial either way.

Step-by-step

Config syntax

haproxy -c -f /etc/haproxy/haproxy.cfg

Compare disk vs live

HOST=www.example.com
openssl x509 -noout -serial -in /etc/haproxy/certs/example.pem
echo | openssl s_client -connect "${HOST}:443" -servername "${HOST}" 2>/dev/null \
  | openssl x509 -noout -serial -dates

Soft reload

systemctl reload haproxy
# or:
service haproxy reload

Some distributions use haproxy -sf with the master PID; prefer your packaged unit semantics for consistency.

certbot deploy hook example

#!/bin/bash
set -euo pipefail
haproxy -c -f /etc/haproxy/haproxy.cfg
systemctl reload haproxy

Register the hook in certbot renewal configuration and test with certbot renew --dry-run.

External verify

curl -vI --connect-timeout 10 "https://${HOST}/" 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Repeat for each frontend when VIPs differ.

How to read the output

haproxy -c reports file and line numbers for syntax errors. Fix unrelated errors before blaming TLS; unresolved errors abort safe reload.

Openssl serial after reload must match the renewed PEM unless multiple certificates load via crt-list and you queried the wrong servername.

Reload via systemd should log a signal to the master process. No log entry after hook execution suggests the hook never ran or targeted a different service name.

crt-list files map sni domains to paths; one stale line leaves a single hostname expired while neighbors renew.

Common mistakes

Updating only the default crt while SNI crt-list still references archived paths. Reloading primary HAProxy while keepalived promotes a standby peer without renewed files.

Concatenating cert and key incorrectly after renewal, passing config test but failing TLS handshakes. Running certbot on a different host than the one whose HAProxy binds the public IP.

Using hard restart during connections-sensitive windows when soft reload is available. Forgetting IPv6 frontends that duplicate IPv4 binds with separate crt directives.

SELinux blocking reads of new keys until restorecon runs, masquerading as reload failure.

Load balancer health checks that probe HTTP only may keep serving traffic to HAProxy peers that failed reload on HTTPS frontends. Add TLS-aware synthetics or external checks that catch split pools.

Financial services environments sometimes maintain separate HAProxy pairs for partner APIs and retail sites. Hooks must reload every pair that shares a renewed SAN wildcard or partners see intermittent stale serials.

Certificate transparency logs help confirm issuance occurred even when reload failed. Use them as secondary evidence when arguing whether renewal or presentation broke first.

Mainframe integration teams may depend on HAProxy for TLS offload to legacy protocols. Document which frontend owns those binds so reload haproxy ssl certificate steps reach mainframe cutover windows on time.

Vendor support contracts for HAProxy enterprise builds may recommend alternative graceful mechanisms. Align internal runbooks with vendor guidance but still close tickets only after external openssl agrees.

Observability stacks scraping HAProxy process uptime cannot detect stale TLS. Uptime metrics stay flat while customers see expired certificates until reload completes.

Quarterly audits should sample random frontends, compare crt-list entries to openssl serials, and file corrective tickets when gaps appear without waiting for calendar expiry week pressure.

Change freezes that block reload deploys still allow reading hook logs from the prior renewal. Review letsencrypt or acme.sh logs during freezes to confirm the next thaw includes a mandatory HAProxy reload checklist item before traffic returns.

Post-mortems for reload haproxy ssl certificate misses should name the automation owner who maintains deploy hooks, not only the on-call engineer who clicked reload manually during the bridge.

Inventory every cron job that touches PEM directories and confirm each one ends with config test plus reload, not silent file copies alone.

When to use automation

HAProxy pools multiply reload risk: one missed peer poisons load-balancer health checks intermittently. SSLdays watches live serials per public hostname and alerts at 30, 14, 7, and 1 days, catching both expiry and stale presentation after renewals.

Combine TLS monitoring with RDAP domain expiration when corporate names need registrar lead time. Email notifications cover all plans; Slack and Discord webhooks on paid tiers suit teams running hourly checks across many frontends.

Confirm every hook-fired reload with /check, then register VIP hostnames at /register for ongoing external validation.