如何在负载均衡环境中设置SSL？
这是我们当前的基础设施：
- 共享负载均衡器后面的 2 个 Web 服务器
- dns 指向负载均衡器
- Web 应用程序是在 asp.net 中完成的，带有 wcf 服务
我的问题是如何设置 SSL 证书以支持 https 连接。
以下是我的两个想法：
- SSL 证书终止于负载均衡器。 负载均衡器后面的安全/不安全通信将被转发到 2 个不同的端口。
专业人士：水平缩放时只需要 1 个证书
缺点：我必须通过检查请求的端口来检查安全或不安全 来自（哪里。 我感觉不太对劲
当 IIS 绑定 2 个不同的端口时，WCF 设计将无法工作
（根据此） - SSL 证书在每个服务器上终止？
缺点：需要添加更多证书才能水平扩展，
谢谢
Here is our current infrastructure:
- 2 web servers behind a shared load balancer
- dns is pointing to the load balancer
- web app is done in asp.net, with wcf services
My question is how to set up the SSL certificate to support https connection.
Here are 2 ideas that I have:
- SSL certificate terminates at the load balancer. secure/unsecure communication behind the load balancer will be forwarded to 2 different ports.
pro: only need 1 certificate as I scale horizontally
cons: I have to check secure or not secure by checking which port the request is
coming from. doesn't quite feel right to meWCF by design will not work when IIS is binded 2 different ports
(according to this) - SSL certificate terminates on each of the server?
cons: need to add more certificates to scale horizontally
thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
一定要在负载均衡器处终止 SSL！！！ 其后面的任何东西都不应该在外面可见。 为什么安全/不安全的两个端口不能正常工作？
Definitely terminate SSL at the load balancer!!! Anything behind that should NOT be visible outside. Why wouldn't two ports for secure/insecure work just fine?
您实际上根本不需要更多证书。 由于外部看到的 FQDN 相同，因此您在每台计算机上使用相同证书。
这意味着 WCF（如果您正在使用它）将可以工作。 如果您在消息级别而不是传输级别进行签名/加密，则在外部负载均衡器上终止 SSL 的 WCF 会很痛苦。
You don't actually need more certificates at all. Because the externally seen FQDN is the same you use the same certificate on each machine.
This means that WCF (if you're using it) will work. WCF with the SSL terminating on the external load balancer is painful if you're signing/encrypting at a message level rather than a transport level.
您很可能不需要两个端口。 只需让负载均衡器上的 SSL 虚拟服务器向请求添加 HTTP 标头并检查即可。 这就是我们对 Zeus ZXTM 5.1 所做的事情。
You don't need two ports, most likely. Just have the SSL virtual server on the load balancer add an HTTP header to the request and check for that. It's what we do with our Zeus ZXTM 5.1.
您不必为每个网站都获取证书，因为存在通配符证书之类的东西。 但它必须安装在每台服务器上。 （假设您正在使用子域，如果没有，那么您可以在机器上重复使用相同的证书）
但如果不仅仅是为了轻松配置，我可能会将证书放在负载均衡器上。
You don't have to get a cert for every site there are such things as wildcard certs. But it would have to be installed on every server. (assuming you are using subdomains, if not then you can reuse the same cert across machines)
But I would probably put the cert on the load balancer if not just for the sake of easy configuration.