Contents
Do you need a load balancer for SSL?
SSL certificates cannot be installed on load balancers. To use SSL certificates, you need to install them on the servers assigned to the load balancer. After the installation of the SSL certificates, the encrypted requests are forwarded by the load balancer to the assigned servers via SSL pass-through.
Why terminating SSL at the load balancer level is an issue?
A second reason SSL should terminate at the load balancer is because it offers a centralized place to correct SSL attacks such as CRIME or BEAST. If SSL is terminated at a variety of web servers, running on different OS’s you’re more likely to run into problems due to the additional complexity .
How do I generate a client certificate for SSL?
Creating a Client Certificate for Mutual Authentication
- Create a backup copy of the server truststore file.
- Generate the client certificate.
- Export the generated client certificate into the file client.
- Add the certificate to the truststore file domain-dir /config/cacerts.jks .
- Restart the Application Server.
How to use a load balancer for SSL?
Use a DNS or TCP-based load-balancer (e.g. something like ipchains ): in this case the SSL/TLS connection from the browser will go directly to the back-end node. Direct client-certificate authentication will be possible. Have the load-balancer perform the client-certificate authentication, and simply convey that information to the back-end node.
How to configure report server on a network load balancing cluster?
If you are configuring a report server scale-out to run on a Network Load Balancing (NLB) cluster, you must do the following: Ensure that the NLB cluster is accessible through a virtual server name that maps to the virtual server IP address. A virtual server name is necessary so that you can configure a single point of entry to the NLB cluster.
How does SSL / TLS handshake with client certificate work?
The SSL/TLS handshake with a client certificate requires that the client signs all the handshake messages exchanged between the client and the server at the end, which means that the client must be connected directly to the actually SSL/TLS server requesting the client certificate.
Can a load balancer Trust a back-end node?
Have the load-balancer perform the client-certificate authentication, and simply convey that information to the back-end node. This requires the back-end node to trust the load-balancer to have made the verification properly, but if the back-end node can’t trust the load-balancer, there’s no point using one.