81

If you have 5 web servers behind a load balancer (such as haproxy) and they are serving up content for the same domain, do you need SSL certificates for all the servers, or can you use the same certificate on each server?

I know you can put all SSL requests on a specific server, but that requires distributed session info and hoping it doesn't come to that.

5 Answers 5

79

If you have 5 web servers behind a load balancer (...) do you need SSL certificates for all the servers,

It depends.

If you do your load balancing on the TCP or IP layer (OSI layer 4/3, a.k.a L4, L3), then yes, all HTTP servers will need to have the SSL certificate installed.

If you load balance on the HTTPS layer (L7), then you'd commonly install the certificate on the load balancer alone, and use plain un-encrypted HTTP over the local network between the load balancer and the webservers (for best performance on the web servers).

If you have a large installation, then you may be doing Internet -> L3 load balancing -> layer of L7 SSL concentrators -> load balancers -> layer of L7 HTTP application servers...

Willy Tarreau, the author of HAProxy, has a really nice overview of the canonical ways of load balancing HTTP/HTTPS.

If you install a certificate on each server, then be sure to get a certificate that supports this. Normally certificates can be installed on multiple servers, as long as the servers all serve traffic for one Fully Qualified Domain Name only. But verify what you're buying, certificate issuers can have a confusing product portfolio...

4
  • 3
    You can purchase certificates with Subject Alternative Names from many issuers now. The SAN field allows a certificate that is valid for multiple FQDNs. WARNING... There can be some issues with older web clients (IE6!), in some instances the client will not read the SAN attribute if the Subject attribute has an invalid FQDN. Mar 24, 2011 at 17:24
  • 4
    Plus 1 for linking to that excellent article by Willy Tarreau. Oct 20, 2011 at 19:21
  • 1
    In medium to large installations, doing the SSL offloading at the Big IP or other load-balancer (second option listed above) has the advantages of being faster, more scalable, less complicated (generally one certificate on LB) and less expensive from the certificate licensing side (multi-domain and SAN certs get pricey). Oct 8, 2013 at 18:46
  • Hi @JesperM, for this flow Internet -> L3 load balancing -> layer of L7 SSL concentrators -> load balancers, is multiple load balancers needed, or only 1 instance is enough to do the job? Apr 2, 2020 at 2:17
17

You should be able to use the same certificate on each server. If your web site is www.gathright.com, you should be able to buy a cert for that FQDN. Then you install it on each of your 5 servers behind the balancer.

Alternatively, you can get a separate cert for each web server, but include 'www.gathright.com' as a "Subject Alternative Name", which means each of the 5 certs would be valid for SSL to that general FQDN as well as SSL to the specific server FQDNs.

7
  • 8
    To clarify this response, you will install the cert on the server which generated the request. You would then export the cert from that server along with private key in order to import it on the other servers.
    – Charles
    Sep 25, 2009 at 18:44
  • D'oh! Yeah, I forgot to mention that you need to export the private key. Thanks, Charles. Mar 24, 2011 at 17:20
  • But if I use SAN certs on each server, do they each need the same private key?
    – anschoewe
    Jun 28, 2016 at 0:37
  • @anschoewe, no. They would each have their own private key and you'd have to pay x5 the price if you have 5 computers. Sep 16, 2016 at 18:35
  • 1
    @AlexisWilke - not sure what that means: if they use a SAN cert, they only need one cert, and therefore one key, and therefore 1 price. SAN certs can be used on multiple servers to serve one or more domains; the price goes up when adding domains, not when adding servers
    – dwanderson
    Jun 28, 2018 at 22:23
14

YES, you can use the same certificate and associated private key on all of your servers, if they are behind a load balancer or load balancing reverse proxy and if they are all serving content for the same domain.

Certificates, when signed by a certificate authority, assert that the certificate authority verified the name listed on the certificate. For certificates for websites, that means the website's domain name. Your browser expects that the server it is talking to, if it is talking over HTTPS, presents a certificate bearing the same name as the domain name that the browser thinks it is talking to. (For example, VeriSign is not likely to sign Hacker Joe's certificate for bankofamerica.com. So even if Hacker Joe manages to intercept traffic between you and bankofamerica.com, Hacker Joe won't have a signed certificate for bankofamerica.com and your browser will put up big red warning flags all over the place.)

What matters is that the name on the certificate matches the domain name that the browser thinks it is talking to. You can use the same certificate (with associated private key) bearing the correct name across multiple web servers in a web cluster, so long as they are behind a load balancer.

You can also use an SSL-terminating load balancer, in which case you would use the certificate (with associated private key) on the load balancer, and the web servers wouldn't need certificates because they wouldn't be having anything to do with the SSL.

7

Our setup has worked very well:

https trafic
     |
   pound
     |
http traffic
     |
  haproxy
     |
http traffic 
     |
web server 1 ... web server n

This way pound decrypts the traffic, from here on everything is straight http. Advantages: less configuration on the web servers, one tool for each job. You can max out the CPU on the pound machine, and keep the web servers "normal". You should get at least two of each (pound, haproxy, web servers), if uptime is important.

2
  • 2
    This also assumes that your backend computers are on a safe private network. In the cloud that's not always the case... Sep 16, 2016 at 18:36
  • Hi @jotango, what is pound? Apr 2, 2020 at 2:24
3

AFAIR, you can use the same cert on each server. You can also implement an SSL accelerator and offload all of the SSL traffic to it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .