(Updated Video In Description) How To Setup ACME, Let's Encrypt, and HAProxy HTTPS on pfsense

Updated Version of this video here:

How To Guide For HAProxy and Let's Encrypt on pfSense: Detailed Steps for Setting Up Reverse Proxy

Amazon Affiliate Store

Gear we used on Kit (affiliate Links)

Try ITProTV free of charge and get 30% off!

Use OfferCode LTSERVICES to get 5% off your order at

Tesla Referral Program Offer

Lawrence Systems Shirts and Swag

Digital Ocean Offer Code

HostiFi UniFi Cloud Hosting Service

Protect you privacy with a VPN from Private Internet Access

Google Fi Service Referral Code

More Of Our Affiliates that help us out and can get you discounts!

Twitter

Patreon

Our Forums

GitHub

Discord

Our Web Site

Netgate Hangout Videos
Let's Encrypt on pfSense

Server Load Balancing on pfSense 2.4
#pfsense #Firewalls

[jrtapley]

I’ve spent so many hours getting this running. This is a long overdue video. Thanks for making it!

[WapitiEater]

Good help, thanks. PLT: Disable any existing NAT rules that may exist from previous efforts. Lost about half a day for I 'twigged on to that one. Once NAT was out of the way, this worked perfectly. Thanks!

[CookieStealer]

3 years later and this is still great! Thanks a lot!

[kevinmiddleton]

This video provided that "ah-ha" moment that I needed for my wildcard cert to work in haproxy. Now I can move away from my other load balancer / reverse proxy tool that I have been using and centralize on pfSense.

Thank you!

[deafno]

16:30 The certs in Backend / Server list are not required to get frontend HTTPS offloading to work. I beleive this is for validating backend SSL certs instead.

[raymondfb]

great video, head still spinning a little. slick as snot when it gets up and runs. thank you again for taking the time to make your videos. learned so much.

[bdorr]

Aside from pointing out the one config issue (maybe), Thanks for the video, this was absolutely useful and awesome and I love to not have to port forward and open up 80 just to let letsencrypt verify my cert. This is much more secure method and I really appreciate it

[heavymetal]

Instead of only using a default backend, you'd just create the ACL > action. Prevents people from just hitting your IP:PORT and successfully getting the service without the FQDN. Generally I would avoid a default backend going to a valid service. An example of a use case, is I'm currently using the default to redirect to a backend that redirects to a TCP frontend for non web-services. TCP front has its own ACL to match against, but you get the idea.

[AaronStuder]

33:05 Don't you need to copy the "restart" at the end as well?

[taylom]

This video is AWESOME! It totally helped me out with redirecting multiple subdomains to different ports on a single server. Thank you so much for showing me how to do this!

[mannyAKAmanny]

Didn't see your usual outro where you "and thank you for making it to the end of the video" :) thanks for this video

[michaelmauer]

Thx, the additional certificates (frontend) was key in my search! Thank you

[memphisk]

Great video. I was under the impression that this didn't expose port 443 to the internet. But it does. Still more secure than exposing an server I'm suspecting.

[Dorff_Meister]

Thanks! I've been wanting to do this for a long time and now it's all working on my Netgate/pfSense. My biggest mistake in the process was not moving pfSense from 443 before enabling things. Doh.

[Dorff_Meister]

I've just setup Nginx Proxy Manager (NPM) in a docker container, have it all working, and am in the process of copying the hosts from my HAProxy config (provided by pfsense) to NPM. I'm finding NPM a lot faster to add and manage the configuration. Hopefully I don't find issues or loss in functionality (I'll run the concurrently at least for a while).

[vicoscugnizzo]

Many thanks for many years of contributing to shape a generation of professionals and enthusiasts like me. Pls. do you mind if I make a humble request? IPv6 setups, same videos you made before but emphasizing IPv6 in many forms SLAAC, DHCPv6. Reckon you will be supporting this transition and untangle this complicated setup. I believe many people is avoiding afraid not be able to deliver with quality as the y do in IPv4. Much appreciated.

[CAHOP]

This is perfect. Been looking for a video like this

[zoeydogwablog]

love the hl2 reference with nova prospekt

[daniellunateel]

This video was super helpful but I really wish you had covered the firewall rules in some more depth.

I was having a ton of trouble until I thought to change the firewall rule to allow access to LAN Net instead of to the firewall itself.

Maybe this is super obvious to everyone else but I completely missed it for hours.

[EduardoReyesDPM]

Literally working on this last night using cloudflare with dns mode.... Ty