# Configure Node-RED for TLS termination on reverse proxy

**URL:** <https://discourse.nodered.org/t/configure-node-red-for-tls-termination-on-reverse-proxy/65914>\
**Category:** General\
**Created:** [2 August 2022 07:44 UTC](https://discourse.nodered.org/t/configure-node-red-for-tls-termination-on-reverse-proxy/65914 "2022-08-02T07:44:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AngryMuppet](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@AngryMuppet](https://discourse.nodered.org/u/AngryMuppet)\
**Post date:** [2 August 2022 07:44 UTC](https://discourse.nodered.org/t/configure-node-red-for-tls-termination-on-reverse-proxy/65914/1 "2022-08-02T07:44:42Z")

</div>

Hello community,

I am a (mainly windows) sysadmin who has inherited a pre-bundled OT measurement system / dashboard built on a Pi 4 with Node-Red, Graphana and Postgresql docker containers sitting behind a HAproxy reverse proxy (also in a container) that is trying to do https termination with a self-signed certificate. I am trying to setup a trusted certificate and remove the security warnings.

I've setup the addressing and DNS correctly and created a trusted TLS certificate using our internal Microsoft CA and replaced the certificate in the pi being used by HAproxy which all works, except browsers are still labeling the site insecure even though it trusts the certificate chain and says the certificate is valid. I believe the site is requesting content unencrypted somewhere but i can't figure it out. TBH, i can't be sure it's even Node-Red's fault.

Can anyone offer any wisdom regarding configuring Node-Red for this scenario? Anyone done it before with HAproxy?

My only other lead is maybe it's something to do with WebSockets since i can't find any mention of that in the HAproxy config, but saw it in another example provided by the forums for a different proxy.

Thanks.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [2 August 2022 16:34 UTC](https://discourse.nodered.org/t/configure-node-red-for-tls-termination-on-reverse-proxy/65914/2 "2022-08-02T16:34:55Z")

</div>

I've not used HAproxy but I do use NGINX and I've published info on setting that up with node-red as have others.

This seems to show the entries required for proxying websockets: [HAProxy configuration with Websocket support (github.com)](https://gist.github.com/lackac/3767467)

Note that websockets initially connect over http(s) and then "upgrade" the connection to ws(s). the IP port remains the same for both http and ws.

---

<div class="post-metadata">

**Author:** ![AngryMuppet](https://avatars.discourse-cdn.com/v4/letter/a/ccd318/32.png) [@AngryMuppet](https://discourse.nodered.org/u/AngryMuppet)\
**Post date:** [2 August 2022 22:30 UTC](https://discourse.nodered.org/t/configure-node-red-for-tls-termination-on-reverse-proxy/65914/3 "2022-08-02T22:30:34Z")

</div>

Thanks @TotallyInformation, ill look into that - might take me a few days to get back to it though.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [1 October 2022 22:30 UTC](https://discourse.nodered.org/t/configure-node-red-for-tls-termination-on-reverse-proxy/65914/4 "2022-10-01T22:30:39Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.