SSL Certificate on Load Balancer

Question

I have a load balancer in front of multiple websites, one of which needs an SSL certificate. When I install the SSL certs for that one site on the load balancer, it breaks the HTTPS protocol for all the other sites.

How can I get SSL for this site without disrupting HTTPS for the other sites? Can I just get an SSL cert for the whole load balancer? The URLs are different and do not share top level domains.

Thanks in advance!

Answer 1

Depending on the website(s) behind the load balancer, it sounds like you might need a wildcard cert for *.yourwebsite.com , or something similar if all URLs behind the balancer share a common URL.

You could also generate a cert for one of the specific sites with something like Lets Encrypt.

Answer 2

You can use Let's Encrypt to generate a single certificate that's valid for many domains. The downside is that you will need to regenerate the certificate whenever you add a new domain. Depending on how frequently you do this, you may run into rate limiting from Let's Encrypt...

Here's how you'd request a cert with multiple domains:

certbot certonly --webroot -w /var/www/example/ -d www.example.com -d example.com -w /var/www/other -d other.example.net -d another.other.example.net

Here's how you would add another domain to an existing certificate:

certbot --expand -d existing.com -d example.com -d newdomain.com   

Finally, please use Let's Encrypt's test servers/API until you have finalized your scripts/commands, otherwise you may hit the rate limit sooner... just add --staging to your certbot commands.

I hope this helps!

• Relevant discussion at Let's Encrypt
• CertBot Documentation
• Let's Encrypt Rate Limits
• Let's Encrypt Staging Environment

Answer 3

What you want is SNI and SSL stripping. You should run a virtual host for each SSL domain on your webserver which will then balance the stripped traffic the same way the unencrypted traffic is balanced.