Apache - Virtual Hosting Mass Client Configurable SSL, Reverse Proxy

Question

My scenario is that we host multiple websites for clients and all of the clients sites run on SSL only.

Currently we have a seperate virtual host file for each client for Apache. Each file is pretty much the same except the server name/alias and the ssl configuration part. The rest of the configuration is pretty much just some reverse proxy declarations to tell apache to terminate the ssl and then pass the traffic to the backend IIS (.net site). Note: all the sites run on the same IP, therefore SNI is used and seems to work well (no compliants as yet which is good).

The other main function that we have is that the client is able to log into their 'client portal' (our website) and generate a CSR to go off to a third party to get it signed and return the cert to us. When they generate the CSR, we keep the private keys on the server.

The problem is that:

1) Having a seperate virtual host file for each client is hard to maintain considering that most of the file is the same between them. (Also file descriptor limits are becoming a problem)

2) The client can change their ssl at any time. I.e. they might have only 2 months left on the cert and hence want to login to their account and get a new CSR and change their ssl cert in 2 months. The problem arises that I need to do a 'restart' on apache to reload the certs. Remember all the sites run through the same webserver, so restarting it will affect them all.

Therefore:

1) I am considering moving to the 'Dynamically Configured Mass Virtual Hosting' for Apache, however, according to this site here, the following is stated:

"SSL termination is not possible on the server unless all the dynamically hosted domains are subdomains covered by a wildcard subdomain SSL certificate"

Each site however is it's own domain and not just subdomains.

Is there a way to achieve this mass hosting with dynamic ssl usage in Apache. If not (which i think is the case), what can I put 'infront' of apache to terminate the ssl connection which does not require restarts? (It needs to have some way to change the cert but not affect the other sites that run on the same IP/Webserver)

I.e. (HAProxy/Pound/other??) --> Apache -- > IIS

Answer 1

I would put Hitch TLS proxy in front of apache - https://hitch-tls.org/.

From the feature list:

• Safe for large installations: performant up to 15 000 listening sockets and 500 000 certificates.
• Support for seamless run-time configuration reloads of certificates and listen endpoints.

Unless it is very important for your users to create CSR's and choose CA's themselves, consider enabling hitch with Let's Encrypt and Acmetool. With a little scripting for adding and removing domains respectively, you'll get free certificates for all domains with automatic issuing and automatic renewal. Set and forget = Win:Win.

See: https://info.varnish-software.com/blog/five-steps-to-secure-varnish-with-hitch-and-lets-encrypt