1

I have a load balancer in front of multiple websites, one of which needs an SSL certificate. When I install the SSL certs for that one site on the load balancer, it breaks the HTTPS protocol for all the other sites.

How can I get SSL for this site without disrupting HTTPS for the other sites? Can I just get an SSL cert for the whole load balancer? The URLs are different and do not share top level domains.

Thanks in advance!

1
  • What kind of load balancer do you use?
    – Orphans
    Oct 20, 2017 at 10:01

3 Answers 3

1

Depending on the website(s) behind the load balancer, it sounds like you might need a wildcard cert for *.yourwebsite.com , or something similar if all URLs behind the balancer share a common URL.

You could also generate a cert for one of the specific sites with something like Lets Encrypt.

3
  • 1
    So Let's Encrypt would be used individually for each site and there would be no SSL configuration on the load balancer?
    – Carson
    Oct 20, 2017 at 4:18
  • 1
    Site != server.
    – womble
    Oct 20, 2017 at 5:11
  • Yep- each site could have its own SSL cert generated by Lets Encrypt- and because it is a free generator and the certs only last 3 months, you could set up a cron job to generate a new cert when they expire- here is how you can set that up.
    – conorb
    Oct 21, 2017 at 14:33
0

You can use Let's Encrypt to generate a single certificate that's valid for many domains. The downside is that you will need to regenerate the certificate whenever you add a new domain. Depending on how frequently you do this, you may run into rate limiting from Let's Encrypt...

Here's how you'd request a cert with multiple domains:

certbot certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net

Here's how you would add another domain to an existing certificate:

certbot --expand -d existing.com -d example.com -d newdomain.com   

Finally, please use Let's Encrypt's test servers/API until you have finalized your scripts/commands, otherwise you may hit the rate limit sooner... just add --staging to your certbot commands.

I hope this helps!

0

What you want is SNI and SSL stripping. You should run a virtual host for each SSL domain on your webserver which will then balance the stripped traffic the same way the unencrypted traffic is balanced.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.