Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If I have a HTTP reverse proxy that communicates with it's backends in an untrusted datacenter, or across datacenters, I would want to use HTTPS in the backend, as talked about here:

Reverse Proxy Secure Configuration

How would these SSL certificates be set up though? I can hardly buy and install a new certificate every time the backend IP address changes. Simply ignoring a non-matching common name doesn't seem very secure. Do I setup my own CA where I can auto-generate certificates? Would the proxy use some sort of certificate fixing?

How is this generally done? Is there ready to use software out there I could use?

share|improve this question

1 Answer 1

First, set your CN to be on the FQDN (which is what it should be in the first place), so it doesn't matter what IP address it's on. Second, you could use internal certs if you wanted to, that's one option, however this needs to be extremely locked down and segmented.

Typically what I'd do for something like that is one of two solutions, depending on what was at my disposal:
- Use internally-signed certs on the back end, and on the reverse proxy, use 1 cert purchased with the correct number of "units" of servers that it is frontending. The bonus here is you have separate keys so if one is compromised you aren't compromised the whole way through. You also have the ability to stagger expiration dates so, if one hits expiration, you can take it out of the group (maintain uptime of the app) while you update all of the certs. Make sure that the reverse proxy has the latest expiration date.
- Get an external CA to sign your cert and copy the cert/key from the reverse proxy to the backend servers. Here you have one key in multiple places, so if it is compromised, you're compromised the whole way through. Additionally, if the cert expires, it expires at the same time everywhere, but you still have to update it everywhere when you get a new cert. This is not always legit, but VerSign didn't mind. There are also different costs depending on the user of the server (Active/Passive, Primary/DR, Active/Active, etc.) so be sure to discuss with your CA.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.