HAProxy

Ensure that the HSM is set up, initialized, provisioned, and ready for deployment. Refer to the Luna HSM Product Documentation for more information.

Create a partition that will be used later by HAProxy.

Create and exchange certificates between the Luna Network HSM and the client system. Register the client and assign the partition to create an NTLS connection. Initialize the Crypto Officer and Crypto User roles for the registered partition.

Ensure that the partition is successfully registered and configured. The command to see the registered partitions is:

# /usr/safenet/lunaclient/bin/lunacm

lunacm (64-bit) v10.9.0-65. Copyright (c) 2025 Thales Group. All rights reserved.

Available HSMs:

Slot Id ->          0
Label ->            HAProxy
Serial Number ->    1578908117659
Model ->             LunaSA 7.9.0
Firmware Version -> 7.9.0
Bootloader Version -> 1.1.5
Configuration ->    Luna User Partition With SO (PW) Key Export With Cloning Mode
Slot Description -> Net Token Slot
FM HW Status ->     FM Ready

Current Slot Id: 0

For PED-authenticated HSM, enable partition policies 22 and 23 to allow activation and auto-activation.

Ensure that you have sudo privileges on the client workstation.

Add a user to the hsmusers group.

# sudo gpasswd --add <username> hsmusers

Where <username> is the name of the user you want to add to the hsmusers group.

Ensure that you have sudo privileges on the client workstation.

Remove a user from the hsmusers group.

# sudo gpasswd -d <username> hsmusers

Where <username> is the name of the user you want to remove from the hsmusers group. You must log in again to see the change.

Download the prebuilt Luna Provider toolkit from Thales GitHub/Releases. Alternatively, if you want to build LunaProv yourself, refer to the OpenSSL Integration Guide to compile and install Luna Provider for OpenSSL.

You can follow the instructions provided in the README-PQC-BUILD text file in the docs directory of the downloaded toolkit. The document provides details on compiling and building the provider with OpenSSL.

Untar the downloaded toolkit.

# tar -zxf Luna-OpenSSL-Toolkit.tar.gz

Copy the lunaprov.so file into the OpenSSL modules directory.

# cp builds/linux/rhel/64/3.5/lunaprov.so /usr/lib64/ossl-modules/

Verify that LunaProv support is available along with the default OpenSSL provider.

# openssl list -provider lunaprov -provider default -providers

If the output resembles the example above, it indicates that the OpenSSL Luna Provider is successfully installed and active.

Create a passfile and store the partition password in it.

# echo <partition_password> > /tmp/passfile

<partition_password> must be replaced with the actual password of the partition Crypto Officer.

Open the /etc/Chrystoki.conf file and add the following section.

GemEngine = {
  LibPath = /usr/safenet/lunaclient/lib/libCryptoki2_64.so;
  LibPath64 = /usr/safenet/lunaclient/lib/libCryptoki2_64.so;
  EnableEcGenKeyPair = 1;
  EnableRsaGenKeyPair = 1;
  DisablePublicCrypto = 1;
  EnableRsaSignVerify = 1;
  EnableLoadPubKey = 1;
  EnableLoadPrivKey = 1;
  DisableCheckFinalize = 0;
  IntermediateProcesses = 0;
  DisableEcdsa = 0;
  DisableRand = 0;
  DisableSessionCache = 0;
  EngineInit = "<partition_label>":0:0:passfile=<path_to_passfile>;
  EnableLoginInit = 1;
}

<partition_label> must be replaced with the actual label of the physical or virtual slot.

Create a key pair on Luna HSM.

# openssl genpkey -provider lunaprov -provider default -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -out key.pem

Create a certificate request using the key generated on Luna HSM.

# openssl req -provider lunaprov -provider default -key key.pem -new -out cert.csr

Submit the certificate request to your CA and obtain a CA-signed certificate. Alternatively, you can use a self-signed certificate.

Create a self-signed certificate from the certificate request using the private key generated on Luna HSM.

This integration uses self-signed certificates in a test environment only. For a production environment, we recommend using a more secure method, such as a certificate authority, to issue the certificate. Skip this step if using a CA-signed certificate.

# openssl x509 -provider lunaprov -provider default -signkey key.pem -in cert.csr -req -days 365 -out cert.pem

Copy the private key reference and certificate to a new file at /etc/haproxy/haproxy.pem using the following command:

# cat key.pem cert.pem > /etc/haproxy/haproxy.pem

Open the /etc/haproxy/haproxy.cfg file in a text editor and update the following configuration to allow HAProxy to communicate with Luna HSM, along with the frontend section, to bind the server over TLS using the certificate and keys generated on Luna HSM, as per the example provided here (highlighted in bold):

# Example /etc/haproxy/haproxy.cfg
global
    log 127.0.0.1 local2
    pidfile /var/haproxy/haproxy.pid
    stats socket /var/haproxy/admin.sock mode 660 level admin expose-fd listeners user haproxy group hsmusers
    maxconn 4000
    user haproxy
    group hsmusers
    daemon
    ssl-provider default
    ssl-provider lunaprov
    ssl-propquery "?provider=lunaprov"

defaults
    mode http
    log global
    option httplog
    option dontlognull
    retries 3
    timeout http-request 10s
    timeout queue 1m
    timeout connect 10s
    timeout client 1m
    timeout server 1m
    timeout http-keep-alive 10s
    timeout check 10s

frontend my_frontend
    bind *:80
    use_backend static
    option forwardfor
    bind *:443 ssl crt /etc/haproxy/haproxy.pem

backend static
    balance roundrobin
    server server1.example.com 10.164.76.46:80 check
    server server2.example.com 10.164.78.129:80 check

The actual path for haproxy.cfg may vary depending on the HAProxy installation. Also, the options in haproxy.cfg may vary according to your requirements. Follow the HAProxy documentation for detailed information on each option. Replace the backend server IP/URL as per your environment.

Check the SELinux setting. Set it to permissive mode by running the following command:

# setenforce 0

This will temporarily set SELinux to permissive mode. To make a permanent change, go to /etc/selinux/config and edit the following line:

SELINUX=permissive

Reboot the system for the changes to take effect.

# reboot

If you are using Ubuntu, skip this step.

Ensure that the HAProxy service is configured. An example of how the HAProxy service configuration looks is shown below.

Starting from RHEL 9, systemd's switch from the root user to the haproxy user fails to obtain permission on LunaMutex, which results in a failure to communicate with the Luna HSM virtual partition when the Luna HSM is configured in HA. Refer to the Appendix section if you are running HAProxy on RHEL 9 and have configured the HAGroup virtual slot for HAProxy.

[Unit]
Description=HAProxy Load Balancer
Documentation=man:haproxy(1)
Documentation=file:/usr/share/doc/haproxy/configuration.txt.gz
After=network.target rsyslog.service

[Service]
EnvironmentFile=-/etc/default/haproxy
Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/var/haproxy/haproxy.pid"
ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS
ExecStart=/usr/sbin/haproxy -W -f $CONFIG -p $PIDFILE $EXTRAOPTS
ExecReload=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS
ExecReload=/bin/kill -USR2 $MAINPID
KillMode=mixed
Restart=always
SuccessExitStatus=143
Type=forking

[Install]
WantedBy=multi-user.target

Start the HAProxy service.

# systemctl start haproxy.service

Ensure that you have added the HAProxy service to the firewall daemon to allow traffic through the firewall.

Check the server status and verify that it starts without any error.

# systemctl status haproxy.service -l

Open any browser and access the HAProxy load balancer.

https://<HostName or IP Address>:443

Accept the certificate and verify its details. The certificate that appears must be the same one whose private key is secured on Luna HSM.

Copy the GemEngine toolkit to any directory. Locate the OpenSSL engines directory using gembuild. The script is available in the directory where you extracted the GemEngine toolkit.

# ./gembuild locate-engines

This gives the location of the directory of libgem.so. By default, the OpenSSL engines directory is located at /usr/lib64/openssl/engines.

Copy libgem.so to the engines directory for your OpenSSL version. For example:

# cp builds/linux/rhel/64/1.0.2/libgem.so /usr/lib64/openssl/engines

Verify that GemEngine is loading. Execute:

# openssl engine gem -v

(gem) Gem engine support
     enginearg, openSession, closeSession, login, logout, engineinit,
     CONF_PATH, ENGINE_INIT, ENGINE2_INIT, engine2init, DisableCheckFinalize,
     SO_PATH, GET_HA_STATE, SET_FINALIZE_PENDING, SKIP_C_INITIALIZE,
     IntermediateProcesses

If you are installing OpenSSL from source, follow the README-GEMBUILD text file in the /docs directory. The document provides further details on compiling and building with GemEngine.

Create a passfile and store the partition password in it.

# echo <partition_password> > /tmp/passfile

Open the /etc/Chrystoki.conf file and add the following GemEngine section.

GemEngine = {
  LibPath = /usr/safenet/lunaclient/lib/libCryptoki2_64.so;
  LibPath64 = /usr/safenet/lunaclient/lib/libCryptoki2_64.so;
  EnableDsaGenKeyPair = 1;
  EnableRsaGenKeyPair = 1;
  DisablePublicCrypto = 1;
  EnableRsaSignVerify = 1;
  EnableLoadPubKey = 1;
  EnableLoadPrivKey = 1;
  DisableCheckFinalize = 0;
  IntermediateProcesses = 0;
  DisableEcdsa = 1;
  DisableDsa = 0;
  DisableRand = 0;
  EngineInit = <slot_id>:0:0:passfile=<path_to_passfile>;
  EnableLoginInit = 1;
}

<slot_id> must be replaced with the actual number of the physical or virtual slot ID.

Create a private key.

# openssl genrsa -engine gem -out key.pem

Create a self-signed certificate using the private key above.

# openssl req -engine gem -new -x509 -days 365 -key key.pem -out cert.cer

This integration uses self-signed certificates in a test environment only. For a production environment, we recommend using a more secure method, such as a certificate authority, to issue the certificate.

Copy the private key reference and certificate to a new file at /etc/pki/tls/certs/haproxy.pem using the following command:

# cat key.pem cert.cer > /etc/pki/tls/certs/haproxy.pem

Open the HAProxy configuration file in a text editor. The location of the configuration file varies depending on the HAProxy version. For example:

/etc/opt/rh/rh-haproxy18/haproxy/haproxy.cfg   (For community version)
/etc/hapee-3.0/hapee-lb.cfg                    (For enterprise version)

Make the following changes in the HAProxy configuration file, highlighted in bold.

global
    log 127.0.0.1 local2
    pidfile /var/run/rh-haproxy18-haproxy.pid
    maxconn 4000
    pidfile /var/run/haproxy.pid
    user haproxy
    group hsmusers
    daemon
    ssl-engine gem
    tune.ssl.default-dh-param 2048

defaults
    mode http
    log global
    option httplog
    option dontlognull
    retries 3
    timeout http-request 10s
    timeout queue 1m
    timeout connect 10s
    timeout client 1m
    timeout server 1m
    timeout http-keep-alive 10s
    timeout check 10s

frontend https-in
    bind *:80
    use_backend static
    option forwardfor
    bind *:443 ssl crt /etc/pki/tls/certs/haproxy.pem

backend static
    balance roundrobin
    server server1.example.com 10.164.76.117:80 check
    server server2.example.com 10.164.78.118:80 check

The actual path for the haproxy configuration file may vary depending on the HAProxy installation. Also, the fields in the configuration file may vary according to your requirements. Follow the HAProxy documentation for detailed information on each field. Ensure you add ssl-engine gem to the global section so that OpenSSL can use GemEngine.

Check the SELinux setting. Set it to permissive mode by running the following command:

# setenforce 0

This will temporarily set SELinux to permissive mode. To make a permanent change, go to /etc/selinux/config and edit the following line:

SELINUX=permissive

Reboot the system for the changes to occur.

# reboot

If you are using Ubuntu, skip this step.

Start the HAProxy service.

# systemctl start haproxy.service          (For community version)
# systemctl restart hapee-3.0-lb.service   (For enterprise version)

Ensure that you have added the HAProxy service to the firewall daemon to allow traffic through the firewall.

Check the server status and verify that it starts without any error.

# systemctl status haproxy.service -l

rh-haproxy18-haproxy.service - HAProxy Load Balancer
   Loaded: loaded (/usr/lib/systemd/system/rh-haproxy18-haproxy.service; disabled; vendor preset: disabled)
   Active: active (running) since Fri 2019-03-01 12:08:44 IST; 3s ago
  Process: 17181 ExecStartPre=/opt/rh/rh-haproxy18/root/usr/sbin/haproxy -f $CONFIG -c -q (code=exited, status=0/SUCCESS)
 Main PID: 17189 (haproxy)
    Tasks: 2
   CGroup: /system.slice/rh-haproxy18-haproxy.service
           +-17189 /opt/rh/rh-haproxy18/root/usr/sbin/haproxy -Ws -f /etc/opt/rh/rh-haproxy18/haproxy/haproxy.cfg -p /run/rh-haproxy18-haproxy.pid
           +-17197 /opt/rh/rh-haproxy18/root/usr/sbin/haproxy -Ws -f /etc/opt/rh/rh-haproxy18/haproxy/haproxy.cfg -p /run/rh-haproxy18-haproxy.pid

Mar 01 12:08:42 localhost.localdomain systemd[1]: Starting HAProxy Load Balancer...
Mar 01 12:08:43 localhost.localdomain haproxy[17181]: STC client identity not configured
Mar 01 12:08:44 localhost.localdomain haproxy[17189]: STC client identity not configured
Mar 01 12:08:44 localhost.localdomain systemd[1]: Started HAProxy Load Balancer.

Open a browser and access the HAProxy load balancer.

https://<HostName or IP Address>:443

Accept the certificate and verify its details.

Configure OpenSSL to use GemEngine by executing the steps mentioned in the Configure OpenSSL to use GemEngine section.

Locate the directory where the SSL private key and certificate are located.

Extract the certificate public key using the command below.

# openssl rsa -in server.key -pubout -out pubkey.pem

Here, server.key is the software key.

Extract the private key in PKCS#8 format using the following command.

# openssl pkcs8 -in server.key -topk8 -nocrypt -out privatekey.pem

Here, server.key is the software key.

Using the CMU utility provided with the Luna Client, import the public key and private key to the HSM.

For the public key:

# /usr/safenet/lunaclient/bin/cmu import -inputFile pubkey.pem -label haproxy_public_key -pubkey=rsa

For the private key:

# /usr/safenet/lunaclient/bin/cmu importkey -PKCS8 -in privatekey.pem -keyalg RSA

Provide the partition password when prompted.

Verify that the keys are generated on the Luna HSM partition and note the private key handle, which will be used later.

# /usr/safenet/lunaclient/bin/cmu list

Certificate Management Utility (64-bit) v10.3.0-275. Copyright (c) 2020 SafeNet. All rights reserved.
Please enter password for token in slot 0 : ********
handle=2000001    label=CMU Unwrapped RSA Private Key
handle=2000002    label=haproxy_public_key

If you have multiple keys, you can identify the private key by giving it a label. Use the following command to assign a label to the private key:

# /usr/safenet/lunaclient/bin/cmu setattribute -handle=2000001 -label=haproxy_private_key

Verify that the private key label matches the label of the public key.

# /usr/safenet/lunaclient/bin/cmu list

Certificate Management Utility (64-bit) v10.3.0-275. Copyright (c) 2020 SafeNet. All rights reserved.
Please enter password for token in slot 0 : ********
handle=2000001    label=haproxy_private_key
handle=2000002    label=haproxy_public_key

Copy the SAUTIL utility provided with the OpenSSL toolkit to create the private key reference in software.

# cp /home/gemengine-1.2/builds/linux/rhel/64/1.0.2/sautil /usr/bin/

Run the sautil utility to create a private key reference to the actual private key imported into the Luna HSM.

# sautil -v -s 0 -i 0:0 -a 0:RSA -f HSMKey_ref.pem -o -q --c

Provide the HSM partition password and key handle when prompted. After the sautil command runs successfully, HSMKey_ref.pem is generated.

Remove the private key generated by OpenSSL that was used before importing the key into the Luna HSM, along with the PKCS#8-format key generated earlier.

# rm -rf server.key privatekey.pem

Copy the private key reference and certificate to a new file at /etc/pki/tls/certs/haproxy.pem using the following command:

# cat HSMKey_ref.pem softcert.cer > /etc/pki/tls/certs/haproxy.pem

Here, softcert.cer is the existing certificate that was generated earlier using the software key.

Open the /etc/opt/rh/rh-haproxy18/haproxy/haproxy.cfg file in a text editor and add the following code (highlighted in bold):

global
    log 127.0.0.1 local2
    pidfile /var/run/rh-haproxy18-haproxy.pid
    maxconn 4000
    pidfile /var/run/haproxy.pid
    user haproxy
    group hsmusers
    daemon
    ssl-engine gem
    tune.ssl.default-dh-param 2048

defaults
    mode http
    log global
    option httplog
    option dontlognull
    retries 3
    timeout http-request 10s
    timeout queue 1m
    timeout connect 10s
    timeout client 1m
    timeout server 1m
    timeout http-keep-alive 10s
    timeout check 10s

frontend https-in
    bind *:80
    use_backend static
    option forwardfor
    bind *:443 ssl crt /etc/pki/tls/certs/haproxy.pem

backend static
    balance roundrobin
    server server1.example.com 10.164.76.117:80 check
    server server2.example.com 10.164.78.118:80 check

The actual path for haproxy.cfg may vary depending on the HAProxy installation. In addition, the fields in haproxy.cfg may vary according to your requirements. Follow the HAProxy documentation for detailed information on each field. You must add ssl-engine gem to the global section so that OpenSSL can use GemEngine, and provide the correct certificate location.

Check the SELinux setting. Set it to permissive mode by running the following command:

# setenforce 0

This will temporarily set SELinux to permissive mode. To make a permanent change, go to /etc/selinux/config and edit the following line:

SELINUX=permissive

Reboot the system.

# reboot

If you are using Ubuntu, skip this step.

Restart the HAProxy service.

# systemctl restart haproxy.service

Ensure that you have added the HAProxy service to the firewall daemon to allow traffic through the firewall.

Check the server status and verify that it starts without any error.

# systemctl status haproxy.service

haproxy.service - HAProxy Load Balancer
   Loaded: loaded (/usr/lib/systemd/system/haproxy.service; disabled; vendor preset: disabled)
   Active: active (running) since Tue 2021-02-23 14:40:21 IST; 1h 35min ago
     Docs: man:haproxy(1)
           file:/usr/share/doc/haproxy/configuration.txt.gz
  Process: 164765 ExecStart=/usr/sbin/haproxy -W -f $CONFIG -p $PIDFILE $EXTRAOPTS (code=exited, status=0/SUCCESS)
  Process: 164754 ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS (code=exited, status=0/SUCCESS)
 Main PID: 164775 (haproxy)
    Tasks: 3 (limit: 23814)
   Memory: 24.9M
   CGroup: /system.slice/haproxy.service
           +-164775 /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid
           +-164776 /usr/sbin/haproxy -W -f /etc/haproxy/haproxy.cfg -p /run/haproxy.pid

Feb 23 14:40:21 localhost.localdomain haproxy[164765]: [NOTICE] 053/144021 (164775) : New worker #1 (164776) forked
Feb 23 14:40:21 localhost.localdomain systemd[1]: Started HAProxy Load Balancer.

Open any browser and access the HAProxy load balancer.

https://<HostName or IP Address>:443

Accept the certificate and verify its details.

Install the following packages.

# apt install make gcc perl libpcre3-dev zlib1g-dev -y

Download the HAProxy source file.

# wget https://www.haproxy.org/download/1.8/src/haproxy-1.8.8.tar.gz

Extract it to any location.

# tar xzf haproxy-1.8.8.tar.gz

Change to the directory where you extracted the file.

# cd haproxy-1.8.8

Run the make command with the following flags:

# make TARGET=generic USE_OPENSSL=1 SSL_INC=/usr/local/ssl/include SSL_LIB=/usr/local/ssl/lib/ USE_PCRE=1 USE_ZLIB=1 USE_GETADDRINFO=1 USE_REGPARM=1 USE_PCRE_JIT=1 USE_NS=1

Make sure to provide the correct include and lib paths in SSL_INC and SSL_LIB respectively, for the custom OpenSSL that you have installed.

Install HAProxy.

# make install

Copy the HAProxy binary file to /usr/sbin/haproxy.

# cp /usr/local/sbin/haproxy /usr/sbin/haproxy

Verify that it was installed correctly with the desired custom OpenSSL version.

# haproxy -vv

Create the service file /lib/systemd/system/haproxy.service and add the following lines:

[Unit]
Description=HAProxy Load Balancer
Documentation=man:haproxy(1)
Documentation=file:/usr/share/doc/haproxy/configuration.txt.gz
After=network.target rsyslog.service

[Service]
EnvironmentFile=-/etc/default/haproxy
Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/run/haproxy.pid"
Environment="LD_LIBRARY_PATH=/usr/local/ssl/lib/"
ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS
ExecStart=/usr/sbin/haproxy -W -f $CONFIG -p $PIDFILE $EXTRAOPTS
ExecReload=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS
ExecReload=/bin/kill -USR2 $MAINPID
KillMode=mixed
Restart=always
SuccessExitStatus=143
Type=forking

[Install]
WantedBy=multi-user.target

Make sure to point Environment="LD_LIBRARY_PATH" to the custom OpenSSL lib folder.

Create the haproxy config file /etc/haproxy/haproxy.cfg and add the following lines:

global
    log /dev/log local0
    log /dev/log local1 notice
    stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
    stats timeout 30s
    user haproxy
    group haproxy
    daemon

defaults
    log global
    mode http
    option httplog
    option dontlognull

Add the haproxy user:

# id -u haproxy &> /dev/null || useradd -s /usr/sbin/nologin -r haproxy

Create a directory /run/haproxy.

# mkdir -p /run/haproxy

Reload the daemon and restart the haproxy service.

# systemctl daemon-reload
# systemctl start haproxy.service

Install the Apache server.

# apt install httpd -y

Modify your webpage accordingly in the /var/www/html/index.html file.

Start the httpd service.

# systemctl start httpd

Complete the steps mentioned in the Integrating Luna HSM with HAProxy section.

Stop the haproxy service if it is running.

# systemctl stop haproxy.service

Create the directory in which you want to chroot.

# mkdir -p /var/lib/haproxy

Create the /var/lib/haproxy/usr/safenet directory.

# mkdir -p /var/lib/haproxy/usr/safenet

Mount /usr/safenet/ to /var/lib/haproxy/usr/safenet.

# mount --bind /usr/safenet/ /var/lib/haproxy/usr/safenet/

Create the /var/lib/haproxy/etc directory and copy the /etc/Chrystoki.conf file to it.

# mkdir /var/lib/haproxy/etc
# cp /etc/Chrystoki.conf /var/lib/haproxy/etc/

Provide the haproxy user permission to the /var/lib/haproxy/etc/Chrystoki.conf file.

# setfacl -m u:haproxy:rwx /var/lib/haproxy/etc/Chrystoki.conf

Create the /var/lib/haproxy/tmp directory.

# mkdir /var/lib/haproxy/tmp

Mount /tmp to the /var/lib/haproxy/tmp/ directory.

# mount --bind /tmp/ /var/lib/haproxy/tmp/

Add the following to the global section in the /etc/haproxy/haproxy.cfg file.

chroot /var/lib/haproxy

Reload the daemon and start the haproxy service.

# systemctl daemon-reload
# systemctl start haproxy.service

Ensure that the LunaHALog path is permissible for write operations by the hsmusers group.

# mkdir -p /tmp/halog
# chown -R root:hsmusers /tmp/halog
# chmod -R 775 /tmp/halog

Do not use the /run or /var/run directories for the HAProxy PID and socket files, as these directories are owned by the root user. Create a new directory for the HAProxy PID and socket files, owned by the haproxy user.

# mkdir -p /var/haproxy
# chown -R haproxy:hsmusers /var/haproxy
# chmod -R 755 /var/haproxy

The directory that you created, and to which you assigned ownership and permissions for the haproxy user, must be specified in haproxy.cfg and the haproxy service file.

Update the HAProxy service file configuration as shown below (highlighted in bold).

[Unit]
Description=HAProxy Load Balancer
Documentation=man:haproxy(1)
Documentation=file:/usr/share/doc/haproxy/configuration.txt.gz
After=network.target rsyslog.service

[Service]
User=haproxy
Group=hsmusers
# Kernel privileges required by the Thales HA slot thread framework & port bindings in RHEL 9.
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SYS_ADMIN CAP_IPC_LOCK CAP_SYS_RESOURCE
EnvironmentFile=-/etc/default/haproxy
Environment="CONFIG=/etc/haproxy/haproxy.cfg" "PIDFILE=/var/haproxy/haproxy.pid"
ExecStartPre=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS
ExecStart=/usr/sbin/haproxy -W -f $CONFIG -p $PIDFILE $EXTRAOPTS
ExecReload=/usr/sbin/haproxy -f $CONFIG -c -q $EXTRAOPTS
ExecReload=/bin/kill -USR2 $MAINPID
KillMode=mixed
Restart=always
SuccessExitStatus=143
Type=forking

[Install]
WantedBy=multi-user.target

If you have any HAProxy PID and socket files already generated, remove those files.

Restart the HAProxy service.

# systemctl daemon-reload
# systemctl restart haproxy.service

Open any browser and access the HAProxy load balancer.

https://<HostName or IP Address>:443

Accept the certificate and verify its details. The page loads successfully, confirming that the HAProxy service is running as a non-root user and successfully accessing the Luna HSM HA slot.