Questions[multi-tenancy](server)

We are creating a Content Management System for our company. It is important that this CMS support dynamic domain names on a dynamic number of servers. After many hours of research we felt that Amazon's Elastic Beanstalk was the way to go. One thing that we also require is the ability to dynamically enable SSL for the domains associated with our system.

So in our system, we can create a "site" which will be associated with a domain. When the site is created, we should also have the ability to choose if the domain will be hosted over SSL/TLS. We plan on white-labeling the system and anticipate a large number of domains being associate with it.

I have been exploring the different possibilities for being able to get SSL set up on the servers (or the load balancer) and be able to change what domains are secured on the fly. Here is where I am at:

• Using Amazon's Certificate Manager: this would be the most desired way to go about it. It is integrated with AWS and very easy to use. However, it has several debilitating limitations: 1. You have to verify every domain by email every time you request a new certificate. No big deal except that 2. It cannot apply certs to EC2 instances, only load balancers and load balancers can only be assigned one cert. This means you have to re-verify every domain whenever you want another domain to be secured. No good.
• Using Let's Encrypt on the Load Balancer: this would be the next best way (that I can see) to secure our sites. Whenever a new site needs to be secured we will request a new certificate for all the domains that need SSL. Once the cert is created, we push it to IAM and tell EBS to associate the Load Balancer with the new Cert. The only problem I see with this is that LetsEncrypt limits their certs to 100 domains, as does the non-free but relatively inexpensive SSL provider, SSLMate. Might work for now, but it doesn't scale. Is there an automated SSL provider that has no limit on the number of domains on the cert?
• Using Passthrough SSL: Amazon's Elastic Beanstalk allows you to set it up in such a way so that the load balancer will pass the encrypted traffic straight to the EC2 instances. Then you can allow the EC2 instances to handle the certificates. I can then utilize LetsEncrypt and assign an individual cert for each domain. I run into an issue when considering autoscaling: we will need to duplicate the certs across instances. My solution would be to store the certs in a secured S3 bucket, then have a cron running on all the EC2 instances to pull the new/updated certs over.

Are there any concerns with the last idea? Is there a better solution to what I am trying to do? Am I missing something? A concern? Or maybe a super simple solution to my problem?

Note that I am using docker, so I can set anything up on the server that I need to.

My organization would like to better understand the Amazon RDS architecture. In particular, my managers would like to understand RDS's "tenancy" model, that is, how the service accommodates multiple customers and how an Amazon RDS DB Instance works.

Here are a few possibilities listed in order of offering the most to the least isolation:

1. A DB instance is on a single and exclusive VM running MySQL; no other DB instance runs on this VM
2. A DB instance is just one of several that runs on a given VM, but each DB instance gets its own MySQL instance
3. Multiple DB instances can connect to a single MySQL server on a single VM but special software makes the connection look we are connecting to our own dedicated MySQL instance.

My guess is that number 1 is correct, but my bosses would be happier with something more definitive than just a guess, something like an Amazon white-paper or other document explaining the RDS architecture.

Does anyone have a pointer to such a document?

We host mail for other organizations using a multi-tenanted Exchange 2010 installation.

We want to route to one of two different outbound relays based on which organization is sending the mail.

Is it possible to choose which send connector is used based on the organization?

This is an entirely hypothetical question, I'm not in this situation now.

What happens to your VLAN topology and routing if you run a multi tenant network and you have more than 4096 customers?

Do you have to start "zoning" your network at the highest level in to new trees of routers/switches and start again with reusing VLAN numbers?

I have a cloud-based (Amazon AWS, Rackspace, whatever) multi-tenant SaaS application, and I need to support HTTPS communications for multiple unrelated tenant domains.

As an illustrative example, let's say our SaaS is available at:

https://foo.com

Tenants can access their tenant-specific UI and service endpoints via:

https://tenantA.foo.com
https://tenantB.foo.com
...

This is easy to support today with one wildcard SSL certificate.

However, with our SaaS, our tenants may wish to expose our UI (but branded for them) directly to their own users.

This causes a problem: let's say John Smith is an existing customer of tenantA (and has no knowledge of foo.com). If John Smith is directed to https://tenantA.foo.com, they could easily become confused (e.g. 'who the heck is foo.com? Why am I here? Am I being hacked? Aahhh!').

To avoid this problem, our tenants would set up a subdomain like:

https://foo.tenantA.com

This avoids a lot of end-user confusion: tenantA's users can see a URL they recognize as owned by tenantA and will more readily use the app. But tenantA wants us to host everything about the app, which means foo.com's infrastructure needs to serve the SSL connection.

To that end, we want to support the following:

1. A tenant uploads to us an SSL cert+key for foo.tenantA.com.
2. We take that SSL cert and dynamically install it into a highly available Load Balancing cluster (2 or more LB nodes) that load balances requests to our SaaS application web endpoints.
3. The tenant updates their DNS to have foo.tenantA.com be a CNAME redirect to tenantA.foo.com.

This way our Load Balancer pool will serve/terminate all HTTPS communications to foo.tenantA.com and all requests are load balanced to our SaaS web server cluster.

This means SSL certs should be able to be added and removed from the LB pool at runtime. Changes cannot interrupt the ability to service existing or new HTTPS requests.

Also, as we'll deploy on virtualized hardware (e.g. EC2) with Linux, we don't have access to the hardware/data center. This must be a software-based solution that can run in Linux. It must also be highly-available (2 or more LB 'nodes').

Does anyone know of a concrete solution? For example, can Nginx, HAProxy or Squid (or anything else) be set up to support this? Is there a 'recipe' or existing solution that is documented and suitable?

P.S. Amazon's Elastic Load Balancer (at the time of writing) cannot pragmatically satisfy this need - it would require an Amazon ELB for each tenant domain. Since every ELB needs to 'ping' the web servers, if you had 500 tenants, you'd have 500 ELBs pinging the SaaS web service endpoints - a non-negligible negative performance hit.