up vote 1 down vote favorite
share [g+] share [fb]

Our company has one SSL cert on our load balancer, which secures the HTTPS channel from the user to the load balancer. Traffic internal behind the load balancer just travels over HTTP.

We have a new requirement which will mean installing the SSL cert on all web servers behind the load balancer so as to secure the end-to-end traffic with HTTPS. This is pretty straightforward, but unfortunately there are a LOT of hosts that need the cert. It's very time consuming to have to go to each web server and set up the cert.

Is there a way to just have the cert live in a shared location, and have all the web servers use it? Or some way to make the management of this large number of web servers with certs easier?

link|improve this question
feedback

3 Answers

up vote 1 down vote accepted

There is a good article on Learn IIS that explains how to use PowerShell for acquiring and installing a certificate:

PowerShell Snap-in: Configuring SSL with the IIS PowerShell Snap-in

To enable SSL three steps are involved:

  • Acquiring and installing a certificate
  • Creating an SSL binding in IIS
  • Assigning the certificate to the IP:Port of the IIS binding

and optionally:

  • Enforcing SSL on your web-site
link|improve this answer
feedback
up vote 2 down vote

You can use self-signed certificates from the LB to the webserver.

The encryption level on self-signed is not worse and the cert being used on the way to the user is not self-signed.

Use a self-signed cert with a 10 year validity period. And even if it expires, the encryption still works if the LB just accepts the fact that the certificate is expired.

Or you could perhaps push via a group policy? Unless your servers are not in an AD.

link|improve this answer
There is no need to use ssl from LB to webserver. He is asking if there is simple way to terminate ssl for multiple domains that are balanced. # edit, hm now im not so sure about it either after reading his post again :/ – Hrvoje Špoljar Feb 17 '11 at 19:09
@Hrvoje: Not multiple domains. One SSL cert, wildcard, one domain, many servers behind the LB. – byte Feb 17 '11 at 19:16
Isn't it irrelevant whether we use a self-signed or not? Regardless there is still the management issue of pushing the cert to each web server. The management of the large number of webservers is the crux of the issue here. – byte Feb 17 '11 at 19:17
I was thinking some thoughts I didn't write. I don't think you can push it out unless you do something with powershell or you can do it via AD. See this: support.microsoft.com/kb/313299 So my suggestion was also of there is no automated way, you could use this approach to avoid doing it on all server every year – Frands Hansen Feb 17 '11 at 19:26
Ah gotcha. Well thanks for the information all the same. – byte Feb 17 '11 at 19:27
feedback
up vote 0 down vote

You can make the private key of the cert exportable (bad for security, keep it safe) and export the private key and the cert. Then you should be able to script something in PowerShell (if you're on IIS 7 or 7.5) to import it across whatever servers you want.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.