How to set up SSL in a load balanced environment?

Question

Here is our current infrastructure:

1. 2 web servers behind a shared load balancer
2. dns is pointing to the load balancer
3. web app is done in asp.net, with wcf services

My question is how to set up the SSL certificate to support https connection.

Here are 2 ideas that I have:

1. SSL certificate terminates at the load balancer. secure/unsecure communication behind the load balancer will be forwarded to 2 different ports.
   pro: only need 1 certificate as I scale horizontally
   cons: I have to check secure or not secure by checking which port the request is coming from. doesn't quite feel right to me
   
   WCF by design will not work when IIS is binded 2 different ports
   (according to this)
   
   
2. SSL certificate terminates on each of the server?
   cons: need to add more certificates to scale horizontally

thanks

Landonlandor

Answer 1

Definitely terminate SSL at the load balancer!!! Anything behind that should NOT be visible outside. Why wouldn't two ports for secure/insecure work just fine?

Gomorrah

say for argument sake, if unsecure stays on port 80. and secure forwarded to a random port: x. Doesn't that mean going straight to domain:x bypasses the secure certificate? users might not realize that they're sending communication unencrypted. – Landonlandor

Users wouldn't see the addresses behind the firewall, as the firewall acts as a kind of proxy - it communicates with machines behind, or routes and forwards packets back and forth. (This isn't really that correct, but it's an OK description of what the user would see) – Alpenstock

Check the PCI/DSS standards out as this leaves you vulnerable to having the traffic intercepted within the network. – Frowst

Answer 2

You don't actually need more certificates at all. Because the externally seen FQDN is the same you use the same certificate on each machine.

This means that WCF (if you're using it) will work. WCF with the SSL terminating on the external load balancer is painful if you're signing/encrypting at a message level rather than a transport level.

Alpenstock

seems like this is the best approach to go. so can you give more details on how the setup is like? ssl terminates on all the boxes? not at the domain name level (i.e load balancer?) – Landonlandor

Well when you import the response to the certificate request on one machine you will be able to use the certificate management MMC snapin to export the certificate, including the private key. This can then be imported on other boxes and bound to IIS. However ... what are you meaning by domain name level? Are you saying the load balancer responds to *.domain.example? This complicates things. – Alpenstock

Answer 3

You don't need two ports, most likely. Just have the SSL virtual server on the load balancer add an HTTP header to the request and check for that. It's what we do with our Zeus ZXTM 5.1.

Pedagogue

is SSL virtual server a piece of hardware or a particular setting on the load balancer? – Landonlandor

When you set up a site in a load balancer, you have to specify the IP to listen to and the back end nodes (ip/port) to forward the traffic to. This configuration, as a whole, is generally referred to as a virtual server or "VIP" in some cases. – Pedagogue

Hi @Pedagogue I know it's an old thread but I'm having trouble about setting up a WCF application in IIS behind a ZXTM. Could you help me out with that? Thanks. – Ludeman

Answer 4

You don't have to get a cert for every site there are such things as wildcard certs. But it would have to be installed on every server. (assuming you are using subdomains, if not then you can reuse the same cert across machines)

But I would probably put the cert on the load balancer if not just for the sake of easy configuration.

Rance