Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
We have a load balancer facing the Internet.
It's balancing load towards two systems behind it in the back-end running apache.
How many SSL certificates do I need to buy? - One for the load-balancer only - One for the load-balancer and for each server instance one (3 certs)+ - Only for the server instances (2 certs) - The certificates can be re-used
Also, can I re-use the server certificate as a client certificate to make calls to other backends from the apache servers?
The point of a load-balancer is that all your servers appear to the client as one. So no matter where you handle the TLS (on the load-balancer or on the application servers), you will only need one certificate to ensure that no web browsers will show any HTTPS warnings.
When clients communicate only with the load-balancer (which handles TLS) and you control the network between the load-balancer and the backend servers, there is little reason to encrypt that connection too. But when you do not trust the network and want to use encryption between load-balancer and backend servers, you can use self-signed certificates for that. When you put the certificate on the servers yourself, you know they are trustworthy. So paying a 3rd party to sign them would be pretty superfluous.
There are Virtual IP addresses used by Load Balancers, performing internal routing to the appropriate pools and nodes on the back end. Every Virtual IP address will need a SSL/TLS certificate, meaning that you may have a virtual IP address on the Load balancer pointing to www.gojack.com -this requires one certificate.
For www.gobrian.com, another cert will be needed.
Virtual IP(gojack.com)---> Jack Pool (Load balancing) --to--> Node1, Node2, Node3
The point is you do not need to have another certificate for every server at the back-end which is node1, node2, node3 in this context. However, a new certificate will be needed for every new website (virtual IP in this case).
Rgds.
