1

I have a load balancer in front of multiple websites, one of which needs an SSL certificate. When I install the SSL certs for that one site on the load balancer, it breaks the HTTPS protocol for all the other sites.

How can I get SSL for this site without disrupting HTTPS for the other sites? Can I just get an SSL cert for the whole load balancer? The URLs are different and do not share top level domains.

Thanks in advance!

  • What kind of load balancer do you use? – Orphans Oct 20 '17 at 10:01
1

Depending on the website(s) behind the load balancer, it sounds like you might need a wildcard cert for *.yourwebsite.com , or something similar if all URLs behind the balancer share a common URL.

You could also generate a cert for one of the specific sites with something like Lets Encrypt.

| improve this answer | |
  • 1
    So Let's Encrypt would be used individually for each site and there would be no SSL configuration on the load balancer? – Carson Oct 20 '17 at 4:18
  • 1
    Site != server. – womble Oct 20 '17 at 5:11
  • Yep- each site could have its own SSL cert generated by Lets Encrypt- and because it is a free generator and the certs only last 3 months, you could set up a cron job to generate a new cert when they expire- here is how you can set that up. – conorb Oct 21 '17 at 14:33
0

You can use Let's Encrypt to generate a single certificate that's valid for many domains. The downside is that you will need to regenerate the certificate whenever you add a new domain. Depending on how frequently you do this, you may run into rate limiting from Let's Encrypt...

Here's how you'd request a cert with multiple domains:

certbot certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net

Here's how you would add another domain to an existing certificate:

certbot --expand -d existing.com -d example.com -d newdomain.com   

Finally, please use Let's Encrypt's test servers/API until you have finalized your scripts/commands, otherwise you may hit the rate limit sooner... just add --staging to your certbot commands.

I hope this helps!

| improve this answer | |
0

What you want is SNI and SSL stripping. You should run a virtual host for each SSL domain on your webserver which will then balance the stripped traffic the same way the unencrypted traffic is balanced.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.