2

I'm trying to set up a load balancer in Google Cloud where I can have multiple websites with different certs hit the same external IP and then be passed on to instance groups behind the load balancer. The trouble is, I only see how to use a single cert per IP address. Do I have to get a different IP address for every cert with the load balancer? I could do this, I suppose, but we're hosting hundreds of sites and are trying to enable SSL on all of them, so that seems like a bad way to go.

Looking for any suggestions - thanks!

1
  • A feature request has been opened for this, although it is not yet implemented. You can star the thread to receive any progress updates and resolution. – Kamran Oct 30 '16 at 18:58
1

Since this is certainly a limitation, as a workaround, you could setup a Network Load Balancer and configure your backend to work using SNI. As explained here ¨SNI can secure multiple Apache sites using a single SSL Certificate and use multiple SSL Certificates to secure various websites on a single domain (e.g. www.domain.com, sub.domain.com) or across multiple domains (www.domain1.com, www.domain2.com)—all from a single IP address;¨

0

You basically have two options: either you have a single cname per certificate. Then you need one IP address per certificate. Unfortunately this is not a good idea since this planet is short on IPv4 addresses.

Alternatively, you can use a SAN certificate or a wildcard certificate. Wildcard certificates require that all of your host names are under the same domain name (e.g. www1.example.com, www2.example.com, projects.example.com etc) while subject alterntive name (SAN) certificates can have independent hostnames. See https://en.wikipedia.org/wiki/Subject_Alternative_Name

That means however, that you must be able to perform a single certificate request for all of these domain names. Let's encrypt for example limits the amount of SANs to 100 per certificate. See https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769

Either way, having several certificates bound to a single IP address is not possible on a Google Cloud Load Balancer. And I am not aware of any other server software that could do the job.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.