CODEWITHSUNDEEP
asp.netwcfinfrastructureload-balancing
ronaldwidha
ronaldwidha

Reputation: 1345

How to set up SSL in a load balanced environment?

Here is our current infrastructure:

  1. 2 web servers behind a shared load balancer
  2. dns is pointing to the load balancer
  3. web app is done in asp.net, with wcf services

My question is how to set up the SSL certificate to support https connection.

Here are 2 ideas that I have:

  1. SSL certificate terminates at the load balancer. secure/unsecure communication behind the load balancer will be forwarded to 2 different ports.
    pro: only need 1 certificate as I scale horizontally
    cons: I have to check secure or not secure by checking which port the request is coming from. doesn't quite feel right to me

    WCF by design will not work when IIS is binded 2 different ports
    (according to this)

  2. SSL certificate terminates on each of the server?
    cons: need to add more certificates to scale horizontally

thanks

Upvotes: 7

Views: 9997

Answers (4)

blowdart
blowdart

Reputation: 56490

You don't actually need more certificates at all. Because the externally seen FQDN is the same you use the same certificate on each machine.

This means that WCF (if you're using it) will work. WCF with the SSL terminating on the external load balancer is painful if you're signing/encrypting at a message level rather than a transport level.

Upvotes: 3

Chad Grant
Chad Grant

Reputation: 45382

You don't have to get a cert for every site there are such things as wildcard certs. But it would have to be installed on every server. (assuming you are using subdomains, if not then you can reuse the same cert across machines)

But I would probably put the cert on the load balancer if not just for the sake of easy configuration.

Upvotes: 0

Chris
Chris

Reputation: 28064

You don't need two ports, most likely. Just have the SSL virtual server on the load balancer add an HTTP header to the request and check for that. It's what we do with our Zeus ZXTM 5.1.

Upvotes: 1

Alex Martelli
Alex Martelli

Reputation: 881497

Definitely terminate SSL at the load balancer!!! Anything behind that should NOT be visible outside. Why wouldn't two ports for secure/insecure work just fine?

Upvotes: 4

Related Questions