I think this kinda depends on the situation of your webserver layout, but I recon it would be most logical to install the certificate on your HAproxy instance.
we run Varnish as a caching server for Drupal on port 81…but I notice that all of this gets set up with port 80…so this may not work due to how Varnish handles requests to the site on the alternate port