Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If you have 5 web servers behind a load balancer (such as haproxy) and they are serving up content for the same domain, do you need SSL certificates for all the servers, or can you use the same certificate on each server?

I know you can put all SSL requests on a specific server, but that requires distributed session info and hoping it doesn't come to that.

share|improve this question

5 Answers 5

YES, you can use the same certificate and associated private key on all of your servers, if they are behind a load balancer or load balancing reverse proxy and if they are all serving content for the same domain.

Certificates, when signed by a certificate authority, assert that the certificate authority verified the name listed on the certificate. For certificates for websites, that means the website's domain name. Your browser expects that the server it is talking to, if it is talking over HTTPS, presents a certificate bearing the same name as the domain name that the browser thinks it is talking to. (For example, VeriSign is not likely to sign Hacker Joe's certificate for bankofamerica.com. So even if Hacker Joe manages to intercept traffic between you and bankofamerica.com, Hacker Joe won't have a signed certificate for bankofamerica.com and your browser will put up big red warning flags all over the place.)

What matters is that the name on the certificate matches the domain name that the browser thinks it is talking to. You can use the same certificate (with associated private key) bearing the correct name across multiple web servers in a web cluster, so long as they are behind a load balancer.

You can also use an SSL-terminating load balancer, in which case you would use the certificate (with associated private key) on the load balancer, and the web servers wouldn't need certificates because they wouldn't be having anything to do with the SSL.

share|improve this answer

Our setup has worked very well:

https trafic
     |
   pound
     |
http traffic
     |
  haproxy
     |
http traffic 
     |
web server 1 ... web server n

This way pound decrypts the traffic, from here on everything is straight http. Advantages: less configuration on the web servers, one tool for each job. You can max out the CPU on the pound machine, and keep the web servers "normal". You should get at least two of each (pound, haproxy, web servers), if uptime is important.

share|improve this answer

If you have 5 web servers behind a load balancer (...) do you need SSL certificates for all the servers,

It depends.

If you do your load balancing on the TCP or IP layer (OSI layer 4/3, a.k.a L4, L3), then yes, all HTTP servers will need to have the SSL certificate installed.

If you load balance on the HTTPS layer (L7), then you'd commonly install the certificate on the load balancer alone, and use plain un-encrypted HTTP over the local network between the load balancer and the webservers (for best performance on the web servers).

If you have a large installation, then you may be doing Internet -> L3 load balancing -> layer of L7 SSL concentrators -> load balancers -> layer of L7 HTTP application servers...

Willy Tarreau, the author of HAProxy, has a really nice overview of the canonical ways of load balancing HTTP/HTTPS.

If you install a certificate on each server, then be sure to get a certificate that supports this. Normally certificates can be installed on multiple servers, as long as the servers all serve traffic for one Fully Qualified Domain Name only. But verify what you're buying, certificate issuers can have a confusing product portfolio...

share|improve this answer
    
You can purchase certificates with Subject Alternative Names from many issuers now. The SAN field allows a certificate that is valid for multiple FQDNs. WARNING... There can be some issues with older web clients (IE6!), in some instances the client will not read the SAN attribute if the Subject attribute has an invalid FQDN. –  Ryan Fisher Mar 24 '11 at 17:24
1  
Plus 1 for linking to that excellent article by Willy Tarreau. –  Nathan Hartley Oct 20 '11 at 19:21
    
In medium to large installations, doing the SSL offloading at the Big IP or other load-balancer (second option listed above) has the advantages of being faster, more scalable, less complicated (generally one certificate on LB) and less expensive from the certificate licensing side (multi-domain and SAN certs get pricey). –  Darrell Teague Oct 8 '13 at 18:46

You should be able to use the same certificate on each server. If your web site is www.gathright.com, you should be able to buy a cert for that FQDN. Then you install it on each of your 5 servers behind the balancer.

Alternatively, you can get a separate cert for each web server, but include 'www.gathright.com' as a "Subject Alternative Name", which means each of the 5 certs would be valid for SSL to that general FQDN as well as SSL to the specific server FQDNs.

share|improve this answer
5  
To clarify this response, you will install the cert on the server which generated the request. You would then export the cert from that server along with private key in order to import it on the other servers. –  Charles Sep 25 '09 at 18:44
    
D'oh! Yeah, I forgot to mention that you need to export the private key. Thanks, Charles. –  Ryan Fisher Mar 24 '11 at 17:20

AFAIR, you can use the same cert on each server. You can also implement an SSL accelerator and offload all of the SSL traffic to it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.