0

I'm in the process of just figuring out the process of setting up a gateway server (Using Apache reverse proxy with SSL) to host multiple web sites. I just wanted to confirm which server would require the certificate.

So, for example, if my gateway server was reverse proxying Example1.com (10.0.0.1), Example2.com (10.0.l0.2) and Example3.com (10.0.0.3), would I require:

a) A certificate for each server and it's domain, plus one for the gateway server

b) Just one certificate for the gateway server, with the 3 domains

c) A certificate for each web hosting server

4
  • Do you want the proxy to terminate SSL and load pages from the endpoints over regular http, the proxy to terminate SSL but then also load the pages from the endpoints over separate SSL connections, or the proxy to just forward SSL connections to and from the endpoints without terminating the SSL connection itself? You can configure it in any of those ways, and the answer is different for each.
    – Mike Scott
    Oct 24, 2014 at 11:51
  • Haha ... Yeah I had those options swimming around in my head, but couldn't get them out into words Lol ... I want to retain (At least) the SSL connection from the gateway server to the requesting client. From what you have written, am I to believe that I would require a certificate for each web server, and the proxy server to forward the SSL connection to and from the web servers? Oct 24, 2014 at 11:57
  • Every server that will terminate an SSL connection has to have a certificate -- it can be the same certificate if the domain name(s) are all included in the certificate, and your licence agreement with your certificate supplier permits it. A proxy that forwards an SSL connection without terminating it doesn't need a certificate, but is severely limited in its functionality as it has no access to things like the http headers.
    – Mike Scott
    Oct 24, 2014 at 12:03
  • Okay ... Got that feeling of 'I should have probably researched this more' ... My end goal is to retain a full SSL connection to and from the requesting client and gateway server, I'll see what google has to offer, then maybe bug you a little more Lol Oct 24, 2014 at 12:16

1 Answer 1

0

Typically, you will have the certificate for the application hostname "Example1.com" on the front-end HTTP proxy, and then server-specific certificates on the back-end application-servers, Example2.com and Example3.com.

You could have a single certificate installed inside both of the back-end servers, with no SubjectCN and with the SubjectAlternateName DNS:example2.com,DNS:example3.com.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .