In the described setup, HAProxy is doing SSL termination. See the gist for the cert and crypto parameters. This is getting a A+ from ssllabs.