1

We have the following scenario -

  • 2 Load balancers serving traffic from multiple web servers
  • We have installed SSL certificate with private key on the web servers

Now, my question is, if we need to renew the same certificate on load balancers, do I need to -

  1. Only install the certificate (.cer/.der) on the load balancer

  2. Install the certificate with private key on the load balancer

I am surprised when one of my colleague told me to do step 2. Why should I need to have the private key on the LB, when we already have that installed on the backend server?

Improve this question
4
  • 1
    Are you using some flavor of SSL offloading? If you do, do you use re-encryption or do you terminate the tunnel at the LB?
    – John Wu
    Commented May 23, 2018 at 2:43
  • Great question! I will have to check this with the networking team.
    – Shibasis Sengupta
    Commented May 23, 2018 at 2:54
  • It was confirmed by networking team that the SSL termination is happening at load balancer. So it makes sense to have private key on the LB. So, in that case, will the LB create another tunnel to the webserver?
    – Shibasis Sengupta
    Commented May 23, 2018 at 4:28
  • 1
    Depends how you have it set up, but if your engineer said it is “terminated” at the LB then it may be in the clear from the LB to the web. In which case you might not need the cert on the web at all (although it doesn’t hurt anything).
    – John Wu
    Commented May 23, 2018 at 4:46

1 Answer 1

Reset to default
3

Either you need to install both certificate and private key at the load balancer or none of these.

You need to install both if the load balancer should also to terminate the SSL connection. Such termination is for example done for performance reasons in which case the SSL connection is terminated at the load balancer and forwarded as plain to the final server. Given that you've installed certificate and key at the final server (which would not be needed if it gets only the plain traffic) this is probably not the case in your situation. But it might also be needed for the load balancer to make decision based on the application content, for example to make sure that all traffic with the same cookie always ends up at the same server. In this case the server needs to terminate the SSL traffic too in order to get access to the content and then might talk to the final server either in plain or re-encrypt the traffic using a new SSL connection.

If the load balancer is instead just balancing the traffic based on layer 3/4 information (i.e. source IP+port, destination IP+port) or if it balances based on the server_name extension (SNI) in the ClientHello of the TLS handshake then it does not need to decrypt the traffic which means that it needs neither the certificate nor the private key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .