We have a small managed infrastructure at our workplace.

The network in its simplest form:

Internet (no-ip for DNS) >> (public ip) Firewall (private ips 192.168.X.X/24(NAT)) >> Reverse Proxy >>> Web Servers

Right now, when clients connect to our web services, they must do so via HTTP. We are working towards implementing HTTPS (SSL). Due to the nature of our setup, we use a wildcard SSL certificate.

My questions:

  1. Does the wildcard SSL certificate only need to be installed on the reverse proxy server? It handles all requests to our web servers (of which there are at least 10).

  2. Does the wildcard SSL certificate need to be installed on each web server behind the reverse proxy?

  3. Would there be a need to install or implement the wildcard SSL cert on the firewall?

Thanks in advance for any feedback!

  1. Since the reverse proxy terminates the TLS part of the HTTPS connection the certificate need to be installed there.
  2. This depends on your specific setup: The reverse proxy either speaks plain HTTP (no TLS) to the internal servers or use HTTPS with either certificates created by your own (which need to be trusted by the reverse proxy) or can do use HTTPS with the same public certificate you use externally. Only in the last case the public certificate would need to be installed on the internal server. But this is not the recommended way since it needlessly exposes the secret private key for the public certificate to multiple places which even might have different administrators.
  3. If the firewall is only doing NAT and packet filtering and specifically does not do any content inspection HTTPS traffic (i.e. no Web Application Firewall or similar) then the certificate will not be installed there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.