Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I should preface this by saying I have zero practical knowledge of SSL, and this particular setup seems especially complex. I have a situation as follows: I'm running 3 websites for a client, a copy of each on 2 Linux boxes. The client is running a hardware load balancer between their firewall and the 2 boxes to distribute the traffic between the 2 boxes. Currently, the websites are all on HTTP only, each site has its own IP address on each box and it available on a public url like a.mysite.com, b.mysite.com and c.mysite.com

The client has asked me to switch everything to run under HTTPS and also to try to configure the following setup: create a new domain (under https) https://main.mysite.com with https://main.mysite.com/a/ mappng to a.mysite.com, https://main.mysite.com/b/ mappng to b.mysite.com etc

The primary goal is to switch all 3 sites to HTTPS. The unified under 1 domain thing is a "nice to have". The client has this belief that certificates are expensive, are they?

First of all, I know nothing about buying certificates, setting up SSL etc, so any links to a beginners guide to HTTPS would be greatly appreciated. A rough idea of cert prices would be nice too.

Second, because the webserver software needs a recompile to run under SSL, I'm interested in solutions to this that allow me not to change the webserver software. Would this be a reverse proxy?

Third, is the "unified under 1 domain thing" even possible?

Fourth, how many SSL certs do I need in this case?

cheers!

share|improve this question

3 Answers 3

A Multiple Domain (UCC) SSL certificate is cheaper than the Wildcard SSL often suggested. It only works for 5 domain variations instead of an infinite number that the Wildcard offers but it may be worth considering if your needs are simple.

Either way a Single SSL cert can handle your needs. Only the price and future flexibility differ.

share|improve this answer
    
Many thanks for the reply! Good suggestion with the Multiple Domain cert - again I'd never heard of it. –  TrojanName Jan 21 '10 at 12:13
    
I use the Starfield one from GoDaddy .... its pretty good. –  djangofan Oct 21 '11 at 21:06

Certificates can be as expensive or as cheap as you want them to be. What you likely want is a 'wildcard' certificate, which will allow *.mysite.com to be allowed. Wildcard certs won't be as cheap as single-site certs, but eventually they become cheaper than many single-site ones. You can also get multiple names on a single cert, but this is a one-time thing, where a wildcard cert will allow any name under that common domain root.

You aren't saying which server software you are using. If Apache, which I assume from the "recompile" mention, and you are running it on some form of Unix, try this command:

httpd -t -D DUMP_MODULES | grep -i ssl

If you get back anything saying ssl is there, well, it's there.

If it isn't, it may be able to be dynamically loaded. However, most distributions and package systems are likely to install ssl by default. It's just that common.

I'd also check to see how old your server software is. I get not wanting to change things much, but I think you'll be happier without a reverse proxy to add to the maintenance of this site.

share|improve this answer
    
Many thanks for the reply! I wasn't aware of the wildcard certs - do you know roughly what they cost? $500? $5000? $50000? I'm not running Apache - the software we're running is quite obscure and I'm worried that we may have to make a huge of application changes to switch to HTTPS. Hence my interest in a separate piece of software such as a reverse proxy - my hunch is that it will be less hassle than switching the application software. –  TrojanName Jan 21 '10 at 12:13

I would think you could satisfy this with either a wildcard certificate (expensive):

  • *.mysite.com

Or three certificates (not as expensive):

  • main.mysite.com
  • a.mysite.com
  • b.mysite.com

You should also be able to create a url rewriting rule on the main site to send clients to the correct domain:

This design wouldn't require a change to your server deployment, rather just adding a certificate to each site along with a url rewrite rule on your main site.

And, don't forget to add the redirect url for remapping from http to https:

share|improve this answer
    
Many thanks for the reply! Do you have suggestions for how I would actually implement the SSL? Do I need to run the a.mysite.com, b.mysite.com and c.mysite.com sites under SSL themeslves or just the new site main.mysite.com? I'm worried about this load balancer too - can this cause problems with SSL/TLS? cheers! –  TrojanName Jan 21 '10 at 12:17
    
Yes, you would create three websites and then install each website's respective certificate. The load balancing shouldn't be a problem as long as you have installed the certificates on all web servers and web sites. –  Dscoduc Jan 21 '10 at 17:32
    
Ok, thanks for the input. I think in my case there's probably a bit more to it. I'm currently investigating running a copy of Pound on each of the 2 machines, sitting between the load balancer and the 3 application servers. Pound can run SSL and also handle the redirects. I could probably use Apache, Nginx or Squid too I guess, but I hear good things about Pound. –  TrojanName Jan 22 '10 at 17:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.