Fix SSL

README.md

@@ -180,6 +180,12 @@ stats:
 
 customerrors: true   # Optional (default false)
 
+ssl_mode: default
+
+letsencrypt: {
+  "email": "acme@example.org"
+}
+
 easymapping:
   - port: 80
     hosts:
@@ -196,12 +202,12 @@ easymapping:
       www.host1.com.br: http://host1.com.br
 
   - port: 443
-    ssl_cert: /path/to/ssl/certificate
     hosts:
       host1.com.br: 
         containers:
           - container:80
         redirect-ssl: false
+        ssl: true
 
   - port: 8080
     hosts:

assets/etc/haproxy/conf.d/00-simple-comment.cfg

@@ -1 +0,0 @@
-# Simple file include

assets/scripts/haproxy-reload.sh

@@ -44,13 +44,11 @@ if cmp -s ${CONTROL_FILE} ${CONTROL_FILE}.old ; then
 fi
 
 if [[ ! -z "$1" ]]; then
-    echo "[CONF_CHECK] Initial configuration"
+    echo "[CONF_CHECK] Initial configuration. Skip certbot."
-    RELOAD="false"
 else
     /scripts/certbot.sh
 fi
 
-
 # If Certbot reloads successfully will create the file /tmp/force-reload
 if [ -f /tmp/force-reload ]; then
     echo "[CONF_CHECK] New certificates found..."
@@ -58,7 +56,12 @@ if [ -f /tmp/force-reload ]; then
     rm /tmp/force-reload
 fi
 
+if [[ ! -z "$1" ]]; then
+    echo "[CONF_CHECK] Start haproxy"
+    /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock
+fi
+
 if [[ "$RELOAD" == "true" ]]; then
     echo "[CONF_CHECK] Reloading..."
-    /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -x /var/run/haproxy.sock -sf $(cat /run/haproxy.pid) &
+    /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg $(ls /etc/haproxy/conf.d/*.cfg 2>/dev/null | xargs -I{} echo -f {}) -p /run/haproxy.pid -x /var/run/haproxy.sock -sf $(cat /run/haproxy.pid) &
 fi

assets/scripts/haproxy.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-source /scripts/haproxy-reload.sh initial
+/usr/sbin/haproxy -v
 
-/usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid -S /var/run/haproxy.sock
+source /scripts/haproxy-reload.sh initial
 
 while true; do
     sleep 60

examples/docker/docker-compose.yml

@@ -8,12 +8,9 @@
 # location: https://host1.local/
 #
 # curl -I -H Host:host2.local http://127.0.0.1
-# HTTP/1.1 200 OK
+# HTTP/1.1 301 Moved Permanently
-# accept-ranges: bytes
+# content-length: 0
-# content-length: 3276
+# location: https://host1.local/
-# content-type: text/html; charset=utf-8
-# last-modified: Tue, 16 Aug 2022 15:48:05 GMT
-# date: Tue, 16 Aug 2022 16:36:35 GMT
 #
 # Test SSL:
 # openssl s_client -showcerts -connect 127.0.0.1:443 --servername host1.local
@@ -25,6 +22,7 @@ services:
     image: byjg/easy-haproxy
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
+      - ./host2.local.pem:/certs/haproxy/host2.local.pem
     environment:
       EASYHAPROXY_DISCOVER: docker
       EASYHAPROXY_SSL_MODE: "loose"
@@ -54,11 +52,11 @@ services:
     image: byjg/static-httpserver
     labels:
       easyhaproxy.http.host: host2.local
-      easyhaproxy.http.localport: 8080
       easyhaproxy.http.port: 80
+      easyhaproxy.http.redirect_ssl: true
 
       easyhaproxy.https.port: 443
       easyhaproxy.https.localport: 8080
       easyhaproxy.https.host: host2.local
-      easyhaproxy.https.sslcert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxVENDQXBHZ0F3SUJBZ0lVSWQ1Yjl0OXVxSDc4ZzAyRXpiV0Y2RktWdzNnd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1pERUxNQWtHQTFVRUJoTUNRbEl4RnpBVkJnTlZCQWdNRGxKcGJ5QmtaU0JLWVc1bGFYSnZNUmN3RlFZRApWUVFIREE1U2FXOGdaR1VnU21GdVpXbHliekVOTUFzR0ExVUVDZ3dFUVVOTlJURVVNQklHQTFVRUF3d0xhRzl6CmRESXViRzlqWVd3d0hoY05Nakl3T0RFMU1EUXlOekExV2hjTk1qTXdPREUxTURReU56QTFXakJrTVFzd0NRWUQKVlFRR0V3SkNVakVYTUJVR0ExVUVDQXdPVW1sdklHUmxJRXBoYm1WcGNtOHhGekFWQmdOVkJBY01EbEpwYnlCawpaU0JLWVc1bGFYSnZNUTB3Q3dZRFZRUUtEQVJCUTAxRk1SUXdFZ1lEVlFRRERBdG9iM04wTWk1c2IyTmhiRENDCkFTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTVNLdnJPYWhhdkNYbnZTRjUxMzFocG8KNms2NUM1N2pnUlE4NEZhRGo1TWJKT1ZsWVFWRnRNRzBYT2s3YStoaDV2MWZlNHdIMFI3STZGRG8wVjlzUytzcwprbzVic0VsYzF4WWxnNUhidUtxODl2UlNLZzZFRGx6dHgzQktiaTkxMlBtdDV2RkdOSjE2emN3NzdEVXJRSVhvCjRJL2I0YTNwbUJpV2o0M05vVElybVNXSHRzR3d3T2ozaUR2U3dlcWRZWEpJcjNocEhINXU2cG9oakRvUXZxRHoKSzZNdThwNm1oQ1VLTnM3S0ZKbk5Jbk5HMjVvUVQ2TzBuNE9HdG1nUmpMV29wZEVuT2hNa0tzZklvSTFYdGxYQgpMQkR2N2h1SUNrM3Q1eXd0ZkNReU8wOWtYN2xGSWdkNXJuNytNandINVdOZXFiUUp4dWFxam9YUW5OWlVnVXNDCkF3RUFBYU5UTUZFd0hRWURWUjBPQkJZRUZOaE1CRzhxNmEraUsybkVDd1ZUbjZCOUVYWk9NQjhHQTFVZEl3UVkKTUJhQUZOaE1CRzhxNmEraUsybkVDd1ZUbjZCOUVYWk9NQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSQpodmNOQVFFTEJRQURnZ0VCQUptdWR2eDgrcDVpSVVzVDhmbS9mYlZNMERBNnFXQUxEWVVKblRuM2o2THE0dnBmClBGQytxMUxtdVdmQlFNeXFLckhyUDNlNDkzRWN0WG9pU0taTzZpTjVkVkpJdXIwMk9qR3VpQUVjc1l1WTFuTG4KczlwaWlJK1VFd3hINnV4MU5hSFVuenNXYXVvQnZSaHpqWHZPNlNBVlNaSllhOWRZNW1pelhrbER5RE51RzVVMApsWHY5ZWdNR0JzeTBkRzZlRlhrVTVDUGR4V1U1NDB5STJzQ3RTQWo3eitXUlVENWs3Z0o3dFZvWTMvL2pIUVpHCjVTVFRtbTV0OWtwSVpUV2twdHlKb3M5b1pKRllNSVhxVzJGYzZ0eUxacFJwMzFSNzh0RHM2RVRJa1RvRGMwUlIKano2NnRoNkhJK1psZ0lCUWh3MDkraFlBaEJEZTkrRG1kL1N6UVpjPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gUFJJVkFURSBLRVktLS0tLQpNSUlFdndJQkFEQU5CZ2txaGtpRzl3MEJBUUVGQUFTQ0JLa3dnZ1NsQWdFQUFvSUJBUURFaXI2em1vV3J3bDU3CjBoZWRkOVlhYU9wT3VRdWU0NEVVUE9CV2c0K1RHeVRsWldFRlJiVEJ0RnpwTzJ2b1llYjlYM3VNQjlFZXlPaFEKNk5GZmJFdnJMSktPVzdCSlhOY1dKWU9SMjdpcXZQYjBVaW9PaEE1YzdjZHdTbTR2ZGRqNXJlYnhSalNkZXMzTQpPK3cxSzBDRjZPQ1AyK0d0NlpnWWxvK056YUV5SzVrbGg3YkJzTURvOTRnNzBzSHFuV0Z5U0s5NGFSeCtidXFhCklZdzZFTDZnOHl1akx2S2Vwb1FsQ2piT3loU1p6U0p6UnR1YUVFK2p0SitEaHJab0VZeTFxS1hSSnpvVEpDckgKeUtDTlY3WlZ3U3dRNys0YmlBcE43ZWNzTFh3a01qdFBaRis1UlNJSGVhNSsvakk4QitWalhxbTBDY2JtcW82RgowSnpXVklGTEFnTUJBQUVDZ2dFQkFLY2VpdFZST1FRNWUvbXhSUjlDZksxc05IL0gzTmUzLzFQa0I2WElyRmFiCnFCM2V2RWF0Wk91b243QTZOS0VlVGpsMzdTZStwZFNWWk9VWGNxQy9CemJyYVpyZTMrRWhya3BJajcyQXBWK1kKMml3WmlXVmFhSlFnSTR1WjNtTkF3OFJhV0pzajVTMWE5SThMRE9pUTVJWjQ1Q212QUJEUEplTVNjdkpTdlJSWQplNU4wTDZzdHFTN1orSW95R1ZLVWZwMWlOTzBZeXl3T1VpU2tJUlhnc2N1UlhaR1lwaUdQb21zSitKczFlanpXCmp5U3RsWkpFcjRMMTI4NXJHUHJtSHFqVHdGZCtoRzgwV2M0MTc5eEwrV1JFNkhCRVVaU2l5OTVmZTZrY1BIWFgKQmdpVll0Y0ZLbWlCaTJkVGJ4bDRlOTR1dDIzOWkwSHRsSjFaSnRMaCtCRUNnWUVBOGEyOThLMnpYa0hvc3hoTgp0UnJIN1hmTVBUa0hERGQzcnhNMjFMVCtmSVhxaW5HVXA5TFlhRGNianVUUHM4ZTMzdUtNZDdSNlE0MHg4OXlXCklYTmthL1ZMMFBYVWVWNjdhQ1ZMTHFnWERMR3VkbHVKaW5IMFh2bUkwQ21CZWNGU01xSUZtUWxncUVSb0dHczMKVU1hYzBwODc2VDRYa0dRUUpkZjYyYkZwRTRVQ2dZRUEwREJIMFBEbE9wd1hjY0RnWHJNZmF5cjhIQWhJK0c1Ugp5V1EvLzlpaXJ0VTgzY2h3SVd3a2g1M2VMTE16TGdkcUpuUGlXeWFVVzVCcXptWXVEMjNuaHhjUTdQTmRJcU9PCkgxc0U2enFMTnNodjQ2dDVRS2xoMVE0cWpkN1VxdGdyU3JZNjNSWEpDTVdUd25OTWVETHRqOGdhS2Jqa3JHM1IKQk0yaWxkdDZVbzhDZ1lCWDdORFVsaTFTbG9IMVhsc3ZEMDQ3UzhGSGFNN3lsOTk0RjNKMFVtRGZwc3pjajFQNAo5cEY2NE1tcTQvM1l0MGxpMG1NdVRiL0pnYjN4cllnRkpYa2NlY0thaEVWSDNyb3B1cCt1bXNMQUFJaXJVTVFxClZTa0Z3SjBRdG5qL2RlRFV3UE51YU9YOGNkNjVPNUNGVjZ6SVI5eEJFREQ4ZkJzUDJaTE96bWVmRFFLQmdRREYKbTI0dlZ0aGQvMWNKZENnRCswVnhOWVhESGVJVlhMRm8xUzBpTFlDTkxuM3RqWmxSUUJLVVh6WkplM2F5MC9yZgpzTk5EN2FTWUhNWWtUenlkREpiYzFQb056eG15RFVpVFhwT1dxeVVFeE0vZmJCMVZVUEU1aDQ3QXhxZFoyb0dOCkV0ZGdqcE1aTG1DSUMyU2tHc0wrM05Kb2s4VUtIZHB1RXJtbVFJTWs1UUtCZ1FDZ0VXY1l0TFhDM1lEWU1GZEkKVWdjVGViRnFTczNtTFlndWIxeGVrVzNJWFIyeW9tNFY1ZlFUTGlGN1lmbjJkcERXNEljTVUwVUpGWVZzVWxoSwphR3RldDRWbTVObjgrTWdob3Q1eUFqcU85eUFVYXViN3dnaWZLSWU5OXRRS2Q4dVp5Q3ZKMGhodm1ERFNmeDRtCkIvVEVpRkFPOTl5RjQ5aVN4RVZTQVM2cHFRPT0KLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=
+      easyhaproxy.https.ssl: true
 

examples/docker/host2.local.pem

@@ -0,0 +1,50 @@
+-----BEGIN CERTIFICATE-----
+MIIDqTCCApGgAwIBAgIUId5b9t9uqH78g02EzbWF6FKVw3gwDQYJKoZIhvcNAQEL
+BQAwZDELMAkGA1UEBhMCQlIxFzAVBgNVBAgMDlJpbyBkZSBKYW5laXJvMRcwFQYD
+VQQHDA5SaW8gZGUgSmFuZWlybzENMAsGA1UECgwEQUNNRTEUMBIGA1UEAwwLaG9z
+dDIubG9jYWwwHhcNMjIwODE1MDQyNzA1WhcNMjMwODE1MDQyNzA1WjBkMQswCQYD
+VQQGEwJCUjEXMBUGA1UECAwOUmlvIGRlIEphbmVpcm8xFzAVBgNVBAcMDlJpbyBk
+ZSBKYW5laXJvMQ0wCwYDVQQKDARBQ01FMRQwEgYDVQQDDAtob3N0Mi5sb2NhbDCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMSKvrOahavCXnvSF5131hpo
+6k65C57jgRQ84FaDj5MbJOVlYQVFtMG0XOk7a+hh5v1fe4wH0R7I6FDo0V9sS+ss
+ko5bsElc1xYlg5HbuKq89vRSKg6EDlztx3BKbi912Pmt5vFGNJ16zcw77DUrQIXo
+4I/b4a3pmBiWj43NoTIrmSWHtsGwwOj3iDvSweqdYXJIr3hpHH5u6pohjDoQvqDz
+K6Mu8p6mhCUKNs7KFJnNInNG25oQT6O0n4OGtmgRjLWopdEnOhMkKsfIoI1XtlXB
+LBDv7huICk3t5ywtfCQyO09kX7lFIgd5rn7+MjwH5WNeqbQJxuaqjoXQnNZUgUsC
+AwEAAaNTMFEwHQYDVR0OBBYEFNhMBG8q6a+iK2nECwVTn6B9EXZOMB8GA1UdIwQY
+MBaAFNhMBG8q6a+iK2nECwVTn6B9EXZOMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
+hvcNAQELBQADggEBAJmudvx8+p5iIUsT8fm/fbVM0DA6qWALDYUJnTn3j6Lq4vpf
+PFC+q1LmuWfBQMyqKrHrP3e493EctXoiSKZO6iN5dVJIur02OjGuiAEcsYuY1nLn
+s9piiI+UEwxH6ux1NaHUnzsWauoBvRhzjXvO6SAVSZJYa9dY5mizXklDyDNuG5U0
+lXv9egMGBsy0dG6eFXkU5CPdxWU540yI2sCtSAj7z+WRUD5k7gJ7tVoY3//jHQZG
+5STTmm5t9kpIZTWkptyJos9oZJFYMIXqW2Fc6tyLZpRp31R78tDs6ETIkToDc0RR
+jz66th6HI+ZlgIBQhw09+hYAhBDe9+Dmd/SzQZc=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDEir6zmoWrwl57
+0hedd9YaaOpOuQue44EUPOBWg4+TGyTlZWEFRbTBtFzpO2voYeb9X3uMB9EeyOhQ
+6NFfbEvrLJKOW7BJXNcWJYOR27iqvPb0UioOhA5c7cdwSm4vddj5rebxRjSdes3M
+O+w1K0CF6OCP2+Gt6ZgYlo+NzaEyK5klh7bBsMDo94g70sHqnWFySK94aRx+buqa
+IYw6EL6g8yujLvKepoQlCjbOyhSZzSJzRtuaEE+jtJ+DhrZoEYy1qKXRJzoTJCrH
+yKCNV7ZVwSwQ7+4biApN7ecsLXwkMjtPZF+5RSIHea5+/jI8B+VjXqm0Ccbmqo6F
+0JzWVIFLAgMBAAECggEBAKceitVROQQ5e/mxRR9CfK1sNH/H3Ne3/1PkB6XIrFab
+qB3evEatZOuon7A6NKEeTjl37Se+pdSVZOUXcqC/BzbraZre3+EhrkpIj72ApV+Y
+2iwZiWVaaJQgI4uZ3mNAw8RaWJsj5S1a9I8LDOiQ5IZ45CmvABDPJeMScvJSvRRY
+e5N0L6stqS7Z+IoyGVKUfp1iNO0YyywOUiSkIRXgscuRXZGYpiGPomsJ+Js1ejzW
+jyStlZJEr4L1285rGPrmHqjTwFd+hG80Wc4179xL+WRE6HBEUZSiy95fe6kcPHXX
+BgiVYtcFKmiBi2dTbxl4e94ut239i0HtlJ1ZJtLh+BECgYEA8a298K2zXkHosxhN
+tRrH7XfMPTkHDDd3rxM21LT+fIXqinGUp9LYaDcbjuTPs8e33uKMd7R6Q40x89yW
+IXNka/VL0PXUeV67aCVLLqgXDLGudluJinH0XvmI0CmBecFSMqIFmQlgqERoGGs3
+UMac0p876T4XkGQQJdf62bFpE4UCgYEA0DBH0PDlOpwXccDgXrMfayr8HAhI+G5R
+yWQ//9iirtU83chwIWwkh53eLLMzLgdqJnPiWyaUW5BqzmYuD23nhxcQ7PNdIqOO
+H1sE6zqLNshv46t5QKlh1Q4qjd7UqtgrSrY63RXJCMWTwnNMeDLtj8gaKbjkrG3R
+BM2ildt6Uo8CgYBX7NDUli1SloH1XlsvD047S8FHaM7yl994F3J0UmDfpszcj1P4
+9pF64Mmq4/3Yt0li0mMuTb/Jgb3xrYgFJXkcecKahEVH3ropup+umsLAAIirUMQq
+VSkFwJ0Qtnj/deDUwPNuaOX8cd65O5CFV6zIR9xBEDD8fBsP2ZLOzmefDQKBgQDF
+m24vVthd/1cJdCgD+0VxNYXDHeIVXLFo1S0iLYCNLn3tjZlRQBKUXzZJe3ay0/rf
+sNND7aSYHMYkTzydDJbc1PoNzxmyDUiTXpOWqyUExM/fbB1VUPE5h47AxqdZ2oGN
+EtdgjpMZLmCIC2SkGsL+3NJok8UKHdpuErmmQIMk5QKBgQCgEWcYtLXC3YDYMFdI
+UgcTebFqSs3mLYgub1xekW3IXR2yom4V5fQTLiF7Yfn2dpDW4IcMU0UJFYVsUlhK
+aGtet4Vm5Nn8+Mghot5yAjqO9yAUaub7wgifKIe99tQKd8uZyCvJ0hhvmDDSfx4m
+B/TEiFAO99yF49iSxEVSAS6pqQ==
+-----END PRIVATE KEY-----

examples/static/docker-compose.yml

@@ -8,7 +8,7 @@ services:
     image: byjg/easy-haproxy
     volumes:
       - ./config.yml:/etc/haproxy/easyconfig.yml
-      - ./certs:/certs
+      - ./host1.local.pem:/certs/haproxy/host1.local.pem
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       EASYHAPROXY_DISCOVER: static

templates/frontend-mode-http.j2

@@ -14,7 +14,7 @@
     use_backend letsencrypt_backend if is_letsencrypt_{{ host }} is_rule_{{ host }}_1 OR is_letsencrypt_{{ host }} is_rule_{{ host }}_2
     {% endif %}
     {% if o["hosts"][k]["redirect_ssl"] %}
-    http-request redirect scheme https code 301 if !is_letsencrypt_{{ host }} is_rule_{{ host }}_1 OR !is_letsencrypt_{{ host }} is_rule_{{ host }}_2
+    http-request redirect scheme https code 301 if {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_1 OR {% if letsencrypt %}!is_letsencrypt_{{ host }} {% endif %}is_rule_{{ host }}_2
     {% else %}
     use_backend srv_{{ host }} if is_rule_{{ host }}_1 OR is_rule_{{ host }}_2
     {% endif %}

tests/expected/services-redirect-ssl.txt

@@ -1,18 +1,16 @@
 global
     log stdout  format raw  local0  info
     maxconn 2000
-    tune.ssl.default-dh-param 2048
+    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
-
-    # intermediate configuration
-    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
     ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+    ssl-default-bind-options no-sslv3 no-tls-tickets
 
-    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
+    ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA
     ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
+    ssl-default-server-options no-sslv3 no-tls-tickets
+
+    ssl-dh-param-file /etc/haproxy/dhparam-1024
 
-    ssl-dh-param-file /etc/haproxy/dhparam
 
 defaults
     log global
@@ -28,11 +26,11 @@ frontend http_in_80
 
     acl is_rule_host2_local_80_1 hdr(host) -i host2.local
     acl is_rule_host2_local_80_2 hdr(host) -i host2.local:80
-    use_backend srv_host2_local_80 if is_rule_host2_local_80_1 OR is_rule_host2_local_80_2
+    http-request redirect scheme https code 301 if is_rule_host2_local_80_1 OR is_rule_host2_local_80_2
 
     acl is_rule_host1_local_80_1 hdr(host) -i host1.local
     acl is_rule_host1_local_80_2 hdr(host) -i host1.local:80
-    http-request redirect scheme https code 301 if !is_letsencrypt_host1_local_80 is_rule_host1_local_80_1 OR !is_letsencrypt_host1_local_80 is_rule_host1_local_80_2
+    http-request redirect scheme https code 301 if is_rule_host1_local_80_1 OR is_rule_host1_local_80_2
 
 backend srv_host2_local_80
     balance roundrobin
@@ -40,14 +38,14 @@ backend srv_host2_local_80
     option forwardfor
     http-request set-header X-Forwarded-Port %[dst_port]
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
-    server srv-0 b18a88da403b:8080 check weight 1
+    server srv-0 3571640c480a:80 check weight 1
 backend srv_host1_local_80
     balance roundrobin
     mode http
     option forwardfor
     http-request set-header X-Forwarded-Port %[dst_port]
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
-    server srv-0 78a90f5c2d8a:80 check weight 1
+    server srv-0 5b69bc7fea1b:80 check weight 1
 
 frontend http_in_443
     bind *:443  ssl crt /certs/letsencrypt/ alpn http/1.1 crt /certs/haproxy/ alpn http/1.1
@@ -67,14 +65,14 @@ backend srv_host2_local_443
     option forwardfor
     http-request set-header X-Forwarded-Port %[dst_port]
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
-    server srv-0 b18a88da403b:8080 check weight 1
+    server srv-0 3571640c480a:8080 check weight 1
 backend srv_host1_local_443
     balance roundrobin
     mode http
     option forwardfor
     http-request set-header X-Forwarded-Port %[dst_port]
     http-request add-header X-Forwarded-Proto https if { ssl_fc }
-    server srv-0 78a90f5c2d8a:8080 check weight 1
+    server srv-0 5b69bc7fea1b:8080 check weight 1
 
 backend letsencrypt_backend
     mode http

tests/test_parser.py

@@ -333,7 +333,8 @@ def test_parser_redirect_ssl():
     line_list = load_fixture("services-redirect-ssl")
 
     result = {
-        "customerrors": False
+        "customerrors": False,
+        "ssl_mode": "loose"
     }
 
     cfg = easymapping.HaproxyConfigGenerator(result, CERTS_FOLDER)