Domain certificate update - server.pem

Overview

This article describes how to replace the server.pem certificate used by the HAProxy service in the Veridium platform.

During the VeridiumID Server installation, a self-signed certificate is automatically generated for HAProxy. In production environments, this certificate should be replaced with a trusted certificate issued by a certificate authority (CA).

When the certificate expires or needs to be replaced, administrators can update it through the Veridium Admin Manager interface.

Depending on the deployment architecture, one of the following configurations applies:

• Single certificate setup (same certificate used for all traffic)

• Dual certificate setup (separate certificates for internal and external traffic)

1. Using a Single Certificate for Veridium

This configuration applies when:

• The same FQDN is used for both internal and external services, OR

• Different FQDNs are used but SSL termination occurs at another infrastructure layer

If Veridium is not the first SSL termination layer, the default self-signed server.pem certificate must be replaced with a trusted certificate.

Upload the Trusted Certificate

1. In Veridium Manager, navigate to:

Tools → Haproxy configuration

2. Open the Certificates tab.

3. Choose the certificate upload method:

Option A — PKCS12 (Recommended)

Upload a PKCS#12 file (.p12 / .pfx) containing:

• certificate

• full chain

• private key

Enter the password for the certificate.

Option B — Certificate + Private Key

Upload the certificate chain and private key as separate files.

(Image – certificate upload interface)

After uploading, the interface will display:

• the certificate chain

• detected certificates

• private key type

Save the Configuration

4. Click Save.

During this step:

• the certificate chain is stored

• it is also added to the Veridium server Truststore

Apply the Certificate on the Nodes

5. Navigate to:

Settings → Nodes

6. Expand the Haproxy section.

7. Click the command:

change server.pem

8. In the popup window:

• select all webapp nodes

• click Run

After uploading the certificate chain, the certificates part of the chain and the private key type are displayed below the upload boxes.

Verify the Execution

9. The execution status appears in the Nodes section.

Possible results:

If a node fails:

• click View actions

• open the execution logs for troubleshooting

2. Using Two Certificates (Internal + External)

This configuration applies when:

• Veridium performs the first SSL termination

• Internal and external services use different FQDNs

Two certificates are required:

• serverExt.pem – external traffic

• serverInt.pem – internal traffic

Supported formats:

• PKCS12

• P7B

• PEM

Before uploading certificates, the HAProxy configuration template must be updated.

Updating the HAProxy Configuration

1. Navigate to:

Tools → Tenant configuration

2. Open the Templates tab.

3. Select haproxy.

4. Click View for haproxy.cfg.

5. Search for:

server.pem

For every occurrence:

• comment the line containing server.pem

• uncomment the line referencing serverExt.pem or serverInt.pem

Example:

# ssl crt /etc/veridiumid/haproxy/server.pem
ssl crt /etc/veridiumid/haproxy/serverExt.pem
ssl crt /etc/veridiumid/haproxy/serverInt.pem

This modification typically occurs 10 times in the configuration.

6. Save the configuration.

Apply the Template

7. Navigate to:

Tools → Nodes

8. Expand Haproxy.

9. Run the command:

change Haproxy.cfg

10. Select the webapp nodes.

11. Click Run.

Changing serverExt.pem

1. Navigate to:

Tools → Haproxy configuration

2. Open the Certificates tab.

3. Upload the external certificate using:

• PKCS12 (recommended), or

• Certificate + private key

4. Click Save.

The certificate chain will be automatically added to the server Truststore.

Apply serverExt.pem on Nodes

5. Go to:

Settings → Nodes

6. Expand Haproxy.

7. Run:

change serverExt.pem

8. Select all webapp nodes.

9. Click Run.

Execution results appear in the Nodes section.

Generating and Applying serverInt.pem

To configure the internal certificate, a certificate must first be issued by the internal certificate authority (CA).

Generate the CSR

1. Navigate to:

Tools → Haproxy configuration → CSR

2. Open:

HAPROXY_CNF_BASE64

3. Fill in the required CSR details.

4. Click Save.

Generate Private Key and CSR

5. Click Generate private key

(skip if a private key already exists)

6. Click Generate CSR and download the file.

Issue the Certificate from the CA

Example below uses Microsoft Active Directory Certificate Services.

7. Select Get a certificate.

8. Select Advanced certificate request.

9. Paste the CSR and select:

Certificate Template = Web Server

10. Submit the request.

11. Download the certificate Base64 encoded certificate chain.

Upload the Internal Certificate

12. Download the private key from:

Tools → Haproxy configuration
→ Config details
→ HAPROXY_PUBLIC_CERT_KEY_PEM_BASE64

13. Navigate to:

Tools → Haproxy configuration → Certificates

14. Select Type = CERTIFICATE

15. Upload:

• certificate chain

• private key

16. Click Save.

Apply serverInt.pem

17. Navigate to:

Tools → Nodes

18. Expand Haproxy.

19. Run:

change serverInt.pem

20. Select the webapp nodes and click Run.

Execution status will appear for each node.

(Optional) - Removing the the previous domain certificate from Truststores

1. Navigate to VeridiumID Admin Console → Settings → Certificates → Truststores.

2. Remove the entry for the self-signed certificate from the interface.

Last updated: August 17, 2026