Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I use Amazon's Elastic Load Balancer (ELB) to route traffic between several web servers that host multiple websites (virtual hosts). The web servers act as front-ends (drones) and pull data off of shared NFS/DB servers.

To implement SSL on these websites, I know Amazon allows SSL Termination on the ELB to convert HTTPS requests to standard HTTP on the back-end. Does this work for multiple websites? Can you associate several SSL certificates with a single ELB?

share|improve this question
    
An SSL certificate can be installed on more than one server, but you have to purchase a license for each server. –  Mircea Vutcovici Sep 18 '11 at 3:16
4  
@Mircea: Bollocks. I'd like to put it more pleasantly than that, but I simply cannot. –  womble Sep 18 '11 at 3:33
    
AFAIK, the ELB allows you to install the SSL certificate directly to it. My question is, what if there are several websites that need SSL certificates installed? Can you install more than one SSL certificate with an ELB? –  Trent Scott Sep 18 '11 at 3:36
1  
@Mircea - I agree with womble. You need not purchase licenses to use SSL certificates. –  EEAA Sep 18 '11 at 3:41
1  
Certain CA have terms and conditions stating you have to "license" the it certs for multiple servers. Obviously there is to technical reason, just t&c's. verisign is one example. –  HampusLi Sep 18 '11 at 8:32
show 1 more comment

2 Answers

up vote 4 down vote accepted

No, you can't associate multiple SSL certificates because each SSL certificate requires it's own IP address (SNI? Hah!) and you can only associate one IP address with each ELB.

share|improve this answer
    
How do people who host multiple websites on a server behind an ELB provide SSL? Do they create separate ELBs for each site? –  Trent Scott Sep 18 '11 at 3:38
2  
That's exactly what they do. –  womble Sep 18 '11 at 3:47
    
Thanks @womble! –  Trent Scott Sep 18 '11 at 3:49
    
I'm not sure how amazon does it, but we have 6 IP's as virtual Aliases on our linux box to act as a front end SSL server for 6 different certificates ( ie, eth0:0-eth0:5)we finally got smart on the last one, and did a wildcard cert. –  Brian Sep 18 '11 at 4:09
1  
Yes, that should work. ELB also supports SSL-to-the-backend, where the ELB will create a new SSL connection to your backend and use that, which I don't really see the point of, but some people get very excited about. –  womble Sep 18 '11 at 4:40
show 4 more comments

If each hostname is under a single domain you can use a single wildcard certificate (e.g., *.example.com).

share|improve this answer
    
Unfortunately, they're all different top level domains. –  Trent Scott Sep 18 '11 at 4:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.