Home / server / Questions / 612130
In Process
onassar
Asked: 2014-07-13 09:03:29 +0800 CST

EC2 Load balancer and wildcard/multi-domain SSL certificates

  • 772

I am running three sites through one load balancer (and 2 child-application servers)
One of the site's has an SSL certificate, but I'd like to add a certificate for the other two sites

What is my best route here?
I've found a huge variety of certificates out there, and am a bit confused

I've seen some that are wildcard (eg. limitless subdomains secured for one domain), and some that are multi-domain (eg. up to 100 domains under the one certificate)

Is there a certificate that handles both cases?
Or could I use a multi-domain one to handle subdomains as if it were a wildcard (each site only has 3 or 4 subdomains I need protected)

Would love some guidance here
Link to any articles dealing with this would be appreciate too

security

2 Answers

  1. I'd suggest one certificate per site (that way you can easily add a fourth site, or remove one of the existing, without touching the certs of the others).

    Whether you want a wildcard for each site, or a multidomain which lists all possible subdomains depends on your setup.

    If everything is in one location (EC2), wildcard is probably the cheaper and easier way w/o giving up security.

    If you host stuff (for the same domain) in different locations (EC2 and own datacenter), I'd suggest multi-domain certs for every location. That way if one of the locations gets compromised, they cannot impersonate the other location (which would be possible with the wildcard cert or one multidomain listing all services of that domain).

    • 0

  2. Here's an interesting solution:

    elb-create-lb superawesome --headers --listener "lb-port=443,instance-port=8443,protocol=TCP" --listener "lb-port=80,instance-port=80,protocol=http" --availability-zones us-east-1c   
elb-create-lb unicorns --headers --listener "lb-port=443,instance-port=8445,protocol=TCP" --listener "lb-port=80,instance-port=80,protocol=http" --availability-zones us-east-1c

    Source: http://web.archive.org/web/20150516202333/http://elwoodicious.com/2009/12/23/using-elb-to-serve-multiple-domains-over-ssl-on-ec2-for-giggles

    In my own case, I just created small instance with Nginx. No problem with traffic yet. Flexible configuration. Costs within budget.

    If you have subdomains, use wildcard package.

    • 0