0

The regular setup I know of is a load balancer terminating SSL and then making unencrypted requests to the backend servers.

If I want to have an SSL connection from the load balancer to the backend servers, though, how do I implement that?

The straightforward thing I can think of is having a separate SSL certificate for each backend server, e.g. https://node1.example.com, https://node2.example.com, https://node3.example.com etc that the load balancer connects to.

Is there a better approach to avoid setting up an individual certificate for each backend server?

Improve this question
1

SNI works for backend servers as well, so just have one cert for all backend servers with all the host names in it.

Improve this answer
1

To expand on Sven's answer:

It's possible to set up a single certificate with multiple Subject AltNames (sometimes called a SAN certificate or multi-domain certificate).

Another option is to create a wildcard certificate ("*.example.com") and use it on all relevant hosts.

Certificates should always be handled in a secure manner, but naturally this gets especially important with wildcard certificates that a malicious third-party could use to wreak all kinds of havoc.

Improve this answer
3
  • When I create such a SAN certificate for node1.example.com, node2..., node3... Do I need to then create 9 DNS entries one pointing to each node? – mpaepper Aug 6 '19 at 7:36
  • I meant three pointing to each node. – mpaepper Aug 6 '19 at 8:12
  • No; as Sven said, Server Name Indication should work with all standards-compliant services. Thanks to that, the DNS names of the backend servers doesn't even have to match any of the names in the certificates, as long as the services they run can present themselves as the name the client requested and present a matching certificate that the load balancer accepts. (en.wikipedia.org/wiki/Server_Name_Indication) – Mikael H Aug 6 '19 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.