This future would be great.

Hi Dennis

Any timeframe for this feature to be implemented?

Certification handling is a pain on Load Balancers :( I have to turn of all the 10 tenant's cloudflare (leading to site downtime) to add +1 tenant domain to the cert.

Merged Wildcard HAProxy SSL support into this item \n\n Created by: Stan \n\n If you want to use a wildcard SSL certificate with HAProxy, you have to manually paste the raw HAProxy config into the custom configuration field. It works, but it’s not very user-friendly. It would be much better if the UI supported this directly, similar to how SSL is already handled for regular servers, so users could just upload or reference a .pem file and have everything set up automatically, without needing to write HAProxy config themselves.

It would also be really helpful to manage HTTP-to-HTTPS redirects and preferred domain settings (like forcing www or non-www) directly from the UI at the proxy level. Right now, this is tricky because the generated config already includes port 80 listeners, which can conflict with custom redirect rules. As a result, cleanly setting this up isn’t really possible without overrides. Adding a dedicated redirect option in the load balancer UI, like what already exists for standard server setups, would solve this neatly.

These aren’t critical issues, but they would make things a lot smoother. Since the load balancer feature is used by a smaller group of users, they’re more in the “nice to have” category. Still, for teams that can’t rely on Let’s Encrypt (for example, when using GeoIP restrictions), having proper wildcard certificate and redirect support built into the UI would make the load balancer feel much more complete and easier to use.

This is now live! 🎉

Open your load balancer and go to Sites & SSL. The new Add certificate section adds certificates that are not tied to a site, so the load balancer can serve any domain:

• Let's Encrypt wildcard: enter for example *.example.com,example.com and pick your DNS provider: Cloudflare, DigitalOcean, Route 53, Linode, Hetzner or Bunny, the same as for sites. Every subdomain of a multi-tenant platform is covered by one certificate, without touching the certificate for each new tenant. It renews automatically.
• Let's Encrypt for other domains: any domain pointing to the load balancer, also when it is not a site on one of your servers.
• Existing certificate: paste a certificate (for example a purchased wildcard) and its private key. We check that the key belongs to the certificate and read the domains from it. Useful when Let's Encrypt is not an option, for example with GeoIP restrictions.

Certificates are listed with their status and expiry date, and you can remove them again.

From the merged request: the HTTP to HTTPS redirect is now a setting in the load balancer's Settings. It is on by default, as before. Turn it off to handle redirects yourself in the custom configuration. Forcing www or non-www at the load balancer is not part of this yet.

Thanks everyone for voting and for the patience on this one!