Ah, I didn't realize I could do SSL termination in TCP mode. That would certainly solve our LDAP HA problem with less effort! I'll try that. 

On Wed, Aug 21, 2019 at 8:27 PM Daniel Oetken via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:
Why doesn’t terminating SSL on the proxy work with LDAPS? Because it should, and says so too here: https://www.mail-archive.com/haproxy@formilux.org/msg21657.html

Though, I’m looking into the same thing to add SAN to the server certificate and wondering about similar questions. When you look at “ipa-getcert list” you should see the current certificates already, including their settings, so I was thinking to just stop tracking those old ones and create new ones like you did, except with the exact same options as the old ones (+ SAN). But yeah, I’m not sure if there is anything else involved, or if there is a better way. I only started using freeipa recently.
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org