6

We are discussing with our Operations department about wildcard SSL certificates. Our purpose is to forbid all wildcard certificate (like *.domain.com) for internet exposed web application because of their potential security risks at least in the production environment.

Not taking in consideration the costs associated to the purchase of certificates (one per web application) they claim that the solution is not feasible because all SSL certificates are managed on the load balancer.

I have no experience in managing load balancer; I suppose that it's like an Apache configuration with more than one virtual host, each virtual host with its certificate (i.e. https://www.digicert.com/ssl-support/apache-multiple-ssl-certificates-using-sni.htm). A recent news from Akamai says that SNI is widely adopted (https://blogs.akamai.com/2017/03/reaching-toward-universal-tls-sni.html).

What are the real difficulties in managing many certificates on a load balancer?

Is there some best practices from authoritative source?

  • 3
    There's a lot of "it depends." How many certificates are you talking about? If "multiple" is 10, easily doable. If "multiple" is 10,000, that's more difficult. What kind of load balancer? Most likely, the problem isn't that your Ops people can't handle it, it's that they don't want to handle it. – gowenfawr Mar 30 '17 at 14:34
  • +1 on what gowenfawr said ... I have 6 diff subdomains off my personal domain name and manage them all to be used in 1x load balancer. I would say that in all cases your ops are just being lazy ... regardless of its 10 or 10,000 its simply a config management change and if they have the staff to manage the existing configs then they have the staff to manage the certs accordingly. – CaffeineAddiction Jan 11 '18 at 22:37
1

Not taking in consideration the costs associated to the purchase of certificates (one per web application) they claim that the solution is not feasible because all SSL certificates are managed on the load balancer.

Arguably this is a Server Fault question as it's asking about configuration of a load balancer. It's impossible for us to answer completely because we don't know what setup your company is using. However, generally speaking adding additional certificates should not be difficult; it should be only a few lines of configuration, and the operations folks should have configuration management scripts that allow them to just add another cert into an array and let the tools generate the resulting config.

However, a much more common approach is to use a SAN cert that contains entries for all of the domain names you're expecting to use. Take a look at the certificate here, for instance:

enter image description here

This is also commonly used by CDNs so that they don't need to manage a whole bunch of certificates from each of their clients:

enter image description here

The key problem here of course is that you need to renew the certificate when adding a new domain. To combat this, I would require advance notice that you want to add a new domain, and batch a bunch of them together into a new cert; so if you renew certs every year and add new domains monthly, you'd have twelve certs installed on the load balancer, one for each month.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.