# If pxc-operator enables TLS, does the HAProxy pod need to be configured with certificates?

**URL:** <https://forums.percona.com/t/if-pxc-operator-enables-tls-does-the-haproxy-pod-need-to-be-configured-with-certificates/39940>\
**Category:** Uncategorized\
**Created:** [December 26, 2025, 9:25am UTC](https://forums.percona.com/t/if-pxc-operator-enables-tls-does-the-haproxy-pod-need-to-be-configured-with-certificates/39940 "2025-12-26T09:25:10Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wxc](https://avatars.discourse-cdn.com/v4/letter/w/bc79bd/32.png) [@wxc](https://forums.percona.com/u/wxc)\
**Post date:** [December 26, 2025, 9:25am UTC](https://forums.percona.com/t/if-pxc-operator-enables-tls-does-the-haproxy-pod-need-to-be-configured-with-certificates/39940/1 "2025-12-26T09:25:10Z")

</div>

If pxc-operator enables TLS, does the HAProxy pod need to be configured with a certificate? How is the HAProxy certificate configured?

---

<div class="post-metadata">

**Author:** ![Abhinav\_Gupta](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/abhinav_gupta/32/6262_2.png) [@Abhinav\_Gupta](https://forums.percona.com/u/Abhinav_Gupta)\
**Post date:** [December 26, 2025, 11:39am UTC](https://forums.percona.com/t/if-pxc-operator-enables-tls-does-the-haproxy-pod-need-to-be-configured-with-certificates/39940/2 "2025-12-26T11:39:41Z")

</div>

Percona operator for PXC supports TLS for the following 2 different communications.

- Internal - communication between Percona XtraDB Cluster instances,
- External - communication between the client application and **ProxySQL**.

For HaProxy as a load balancer, only SSL-Internal TLS is applicable.

> **[Percona Operator for MySQL - Transport Encryption (TLS/SSL)](https://docs.percona.com/percona-operator-for-mysql/pxc/TLS.html)**
>
> The Percona Operator for MySQL uses Transport Layer
> Security (TLS) cryptographic protocol for the following types of communication:

---

<div class="post-metadata">

**Author:** ![wxc](https://avatars.discourse-cdn.com/v4/letter/w/bc79bd/32.png) [@wxc](https://forums.percona.com/u/wxc)\
**Post date:** [December 29, 2025, 3:15am UTC](https://forums.percona.com/t/if-pxc-operator-enables-tls-does-the-haproxy-pod-need-to-be-configured-with-certificates/39940/3 "2025-12-29T03:15:27Z")

</div>

Okay, thank you. If my database uses HAProxy as a proxy, which SSL certificate should be used when the business accesses it?

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [December 29, 2025, 6:14pm UTC](https://forums.percona.com/t/if-pxc-operator-enables-tls-does-the-haproxy-pod-need-to-be-configured-with-certificates/39940/4 "2025-12-29T18:14:52Z")

</div>

> [@wxc](#):
>
> does the HAProxy pod need to be configured with a certificate

No. HAProxy, in this instance, operates as a layer-4 proxy, meaning HAProxy does not meddle with the SSL process; it simply passes the connection to the backend MySQL, and MySQL handles the SSL termination.

> [@wxc](#):
>
> which SSL certificate should be used when the business accesses it?

You don’t need to fetch any specific certificate. When accessing MySQL/PXC, SSL negotiation is handled automatically. If you still want the certs, use `kubectl get secrets` and output the secret contents for the non-internal SSL secret. There will be a CA, cert, and key that can be used by client applications.