First, set your CN to be on the FQDN (which is what it should be in the first place), so it doesn't matter what IP address it's on. Second, you could use internal certs if you wanted to, that's one option, however this needs to be extremely locked down and segmented.
Typically what I'd do for something like that is one of two solutions, depending on what was at my disposal:
- Use internally-signed certs on the back end, and on the reverse proxy, use 1 cert purchased with the correct number of "units" of servers that it is frontending. The bonus here is you have separate keys so if one is compromised you aren't compromised the whole way through. You also have the ability to stagger expiration dates so, if one hits expiration, you can take it out of the group (maintain uptime of the app) while you update all of the certs. Make sure that the reverse proxy has the latest expiration date.
- Get an external CA to sign your cert and copy the cert/key from the reverse proxy to the backend servers. Here you have one key in multiple places, so if it is compromised, you're compromised the whole way through. Additionally, if the cert expires, it expires at the same time everywhere, but you still have to update it everywhere when you get a new cert. This is not always legit, but VerSign didn't mind. There are also different costs depending on the user of the server (Active/Passive, Primary/DR, Active/Active, etc.) so be sure to discuss with your CA.
