topic Re: SSL in load a balancing HOWTO?? in Operating System - HP-UX

SSL in load a balancing HOWTO??

HPP — Wed, 15 Jan 2003 21:15:08 GMT

Hi,
we are running a website and it has 6 server at the backend serving the same content. All 6 servers are private on IP address and load balanced through Altheon switch. We running Apache 1.3.27. Now we want to install SSL certificate. On one of the server using openssl I have already generated private key and PEM encoded CSR.
Now question is, should we have to generate Private key and CSR for all the back end servers and get Certificate Authority like verisign to sign or with only one CSR can we manage it??

Any idea how to install SSL certificate in load blancing situation??

Thanks

Re: SSL in load a balancing HOWTO??

Andrew Cowan — Thu, 16 Jan 2003 06:21:54 GMT

The last time I checked Verisign produced a "super certificate" that could for used in cluster and load-balancing situations.

Re: SSL in load a balancing HOWTO??

Ravi_8 — Thu, 16 Jan 2003 06:45:23 GMT

Hi,
here is the piece of info that i have:

http://www.tivoli.com/support/public/Prodman/public_manuals/td/SW_30/pd37_base_install_hpux/en_US/HTML/pd37base-inst-HP38.htm#HDRI1032122

Re: SSL in load a balancing HOWTO??

Tim Maletic — Thu, 16 Jan 2003 13:29:44 GMT

You need one certificate per domain. So if your six server cluster is serving content for a single domain, just install the same certificate on each server.

If the public can view the content, you'll need one of the big CA's to sign it. Note that Verisign has special licensing arrangements for clusters, i.e., you'll be in violation of their license if you just purchase a single server license and install it on multiple hosts.

If the public cannot view the content, just use your own self-signed certificate, and get all client browsers to add your cert to their list of trusted CAs.

Re: SSL in load a balancing HOWTO??

Frerk Friedrichsen_1 — Fri, 17 Jan 2003 09:16:34 GMT

Hi,

I have nearly the same installation.

In my case, i installed the SSL cert. in the loadbalancer. (BIG-IP F5). The loadbalancer has one public IP an serve the SSL cert.
The SSL cert. is bound to one IP adress.

If the Altheon switch can handle SSL cert. you must generate the key and CSR on it.

best regards
Frerk F.