0

I have an application that is hosted with AWS EC2 instance which is behind a load balancer with DNS say example.com. I would like to point multiple domains on a monthly basis to this load balancer (business onboardings). I also have a public certificate generated via AWS CMC. Block diagram for reference -https://i.stack.imgur.com/Dm7z7.jpg

With the addition of a new domain, I'm required to generate a new certificate every time (which is fair) and need to authenticate all the domains (old + newly added) via CNAME (which is really annoying).

Any suggestions to make this simple? I would like to have one Root CA and then add new certificates within them as chain, but is that feasible and is a good practice?

Better approaches are most welcome.

PS: I checked the thread - SSL certificate for CNAME redirected domain , however that looks to be a different use case.

2 Answers 2

1

When you say CMC, do you mean ACM (AWS Certificate Manager)? According to this blog post you can have up to 25 certificates associated with a load balancer, which might be a little simpler to automate.

However, once you get near the limit you're going to have to create a certificate with multiple domains, so I wonder if it's worth spending a bit more time automating it from the beginning. I haven't given how to automate it any thought.

2
  • "You can bind up to 25 certificates per load balancer (not counting the default certificate)" so actually 26 total if you're trying to squeeze absolute max capacity from each ALB. The default certificate is the one the balancer offers to the viewer when none of the other certs match the incoming SNI, or there is no SNI. +1 May 4, 2020 at 23:37
  • Thanks @Tim. That was helpful
    – Harry
    May 5, 2020 at 16:03
0

Network load balancer does the job. It has option to have one default certificate and add additional certificates, individually as required. There is no need to re-authenticate the old domains and we can add/remove domain certificate (public) per requirement.

1
  • Similar the ALB I suggested really. What's the limit? NLB is obviously a lower level system than ALB.
    – Tim
    May 5, 2020 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .