I currently have two webservers behind a load balancer that are running my websites. I'm considering buying an SSL certificate for one of my websites and converting it to https. What mechanics to I need to considerer as far as IP addresses and load balancing go?
asked Mar 11, 2013 at 18:34
-
While I don't have personal experience I have done research in the past for other customers and what I found is that it depends on the load balancer you use. Sometimes you can get away with installing just the one certification on the load balancer itself since thats the first to communicate.– Simon HayterMar 11, 2013 at 19:10
-
I'll have to see what my hosting company support then, thanks.– Stephen Ostermiller ♦Mar 11, 2013 at 20:11
Add a comment
|
2 Answers
You can use nginx as a load balancer and configurate it to correctly handle the server certificates just as normally would happen.
All the configurations are explained in http://www.cyberciti.biz/faq/howto-linux-unix-setup-nginx-ssl-proxy/ Instead of using the self-signed certificates, a purchased one can be used.
I have this working two different ways for two different sites now.
Install the certificate on each of the servers behind the load balancer. The load balancer accepts requests on port 443 and forwards them to the web servers unmodified. The responsibility for the encryption rests at the web server level.
Install the certificate on the load balancer itself. It accepts requests on port 443, handles the encryption and then makes unencrypted requests to the web servers on port 80.
As others have stated, it depends on the capabilities of your load balancer. When the load balancer can handle the encryption, it is very convenient to let it do so.
answered Dec 17, 2013 at 19:09