Multiple SSL certificates on load balancer

Question

We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of their potential security risks at least in the production environment.

Not taking in consideration the costs associated to the purchase of certificates (one per web application) they claim that the solution is not feasible because all SSL certificates are managed on the load balancer.

I have no experience in managing load balancer; I suppose that it's like an Apache configuration with more than one virtual host, each virtual host with its certificate (i.e. https://www.digicert.com/ssl-support/apache-multiple-ssl-certificates-using-sni.htm). A recent news from Akamai says that SNI is widely adopted (https://blogs.akamai.com/2017/03/reaching-toward-universal-tls-sni.html).

What are the real difficulties in managing many certificates on a load balancer?

Is there some best practices from authoritative source?

Answer 1

Not taking in consideration the costs associated to the purchase of certificates (one per web application) they claim that the solution is not feasible because all SSL certificates are managed on the load balancer.

Arguably this is a Server Fault question as it's asking about configuration of a load balancer. It's impossible for us to answer completely because we don't know what setup your company is using. However, generally speaking adding additional certificates should not be difficult; it should be only a few lines of configuration, and the operations folks should have configuration management scripts that allow them to just add another cert into an array and let the tools generate the resulting config.

However, a much more common approach is to use a SAN cert that contains entries for all of the domain names you're expecting to use. Take a look at the certificate here, for instance:

This is also commonly used by CDNs so that they don't need to manage a whole bunch of certificates from each of their clients:

The key problem here of course is that you need to renew the certificate when adding a new domain. To combat this, I would require advance notice that you want to add a new domain, and batch a bunch of them together into a new cert; so if you renew certs every year and add new domains monthly, you'd have twelve certs installed on the load balancer, one for each month.