Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are looking to set up a cloud solution for one of our systems, but we need multiple TLD SSL's

  • We are only allowed 5 public IP's
  • Can't use UCC/Wildcard Certs since each client has own cert and some have different types of certs

I came up with the idea of setting up cloud load balancers for each client requiring SSL, and point the load balancer to our primary web server, on alternative ports...

Client1LoadBalancer -> webserver:444

Client2LoadBalancer -> webserver:445

Client3LoadBalancer -> webserver:446

. . .

ClientNLoadBalancer -> webserver:N

Are there any other approaches or ideas for this to work other than the cloud load balancing approach?

share|improve this question
add comment

2 Answers

Besides using IPs in the cloud, there is one other option I can think of Apache can do SNI. Acording to that link, IE6 does not support SNI ( for when it was written ).

share|improve this answer
    
Thanks Chris, I did have a brief look at SNI and went against it, as for the moment we'd like to keep things in IIS only, and with the amount of users we have, we'd like to keep things ticking with IE6. I should have mentioned that I considered SNI in the first place. –  Albert Jan 22 '12 at 21:11
    
If you use the cloud and proxies, check on it to make sure you log the correct IPs. en.wikipedia.org/wiki/… Another option may be to build some sort of vpn tunnel. –  becomingwisest Jan 22 '12 at 21:20
    
Thanks Chris, this is very useful to know! –  Albert Jan 22 '12 at 23:54
    
IIS8 has support for SNI (Don't know if you're able to make that jump tho). FWIW IIS6 is getting long in the tooth: you may want to check your logs & see how many people are using it :) –  voretaq7 Jan 23 '12 at 1:14
add comment

It looks like the solution may very well be in Server 8, and specifically IIS8, as it supports SNI (Server Namd Indication). "IIS 8.0 support Server Name Indication (SNI), which has extended TLS to include the virtual domain name to be passed from the client at the time of "SSL Hello". This effectively allows IIS 8.0 to enable "hostname binding" for SSL sites, which eliminates the need for having a dedicated IPv4 address per SSL site."

http://blogs.iis.net/wonyoo/archive/2012/03/01/iis-8-0-platform-features-for-web-hosters-and-service-providers.aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.