We have number of web servers serving services and pages behind a single IP address we want to use SSL to secure the connection from the clients to those servers.
We access the web servers from the outside using subdomains and a reverse proxy (IIS 7) listening to the traffic and routing accordingly. E.g. client1.customers.example.com goes to one webserver and client2.customers.example.com goes to another webserver.
What we need
My question is how to access those resources from the outside using SSL? Do I need to put a wildcard certificate on the reverse proxy itself that is signed on *.customers.example.com? (and what are the down sides of using a wildcard certificate?) or should I use different certificate for each domain? or maybe something compeletly different?
- We don't care that the connection within our network (between the reverse proxy and the web servers itself) wouldn't be under SSL.
- I currently have around 4 subdomains (clients 1 throught 4) this number shouldn't grow dramatically but I do want to have some kind of scalability.
- I need to have the middle subdomain (customers.example.com) cause example.com goes to a different IP (not the one that has reverse proxy listening)
Trying to get this SSL thingy once and for all :)
EDIT: There's no other option except for SNI and a "wildcard certificate". I'm now looking for ways to make the reverse-proxy on IIS 7.5 to work with SSL/TLS SNI certificate.
Related questions I've found:
- Securing Two Sub domains on IIS7.5 with SSL on port 443
- Multiple SSL domains on the same IP address and same port?
- Using several SSL certificates on same IP with IIS 7
SOLVED using a wildcard for subdomains under my domain and a ARR extension on my IIS 7.5 server.