SSL 与 AWS Elastic Load Balancing - 静态 IP？
我已向我的提供商索要 SSL 证书。他们说 CSR 必须从具有与证书相关的 IP 地址的主机生成。否则以后就无效了。 据我所知，只能将 CNAME 分配给负载均衡器，并且无法在负载均衡器上生成 CSR。除此之外，lb ip 可能会改变。那么你拿到有效证件了吗？
问候， 吉姆
I've asked my provider for a SSL certificate. They said the CSR must be generated from a host having the ip address which blongs to the certificate. Otherwise it will not be vaild later.
As far as I know one can only assign a CNAME to a load balancer and it is not possible to generate the CSR on the load balancer. Apart from that the lb ip might change. So do you get your valid certificates?
Regards,
Jim
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您不必在负载均衡器上生成 CSR。您只需使用由所需域名组成的名称来生成它。你可以在任何地方这样做。
You don't have to generate the CSR on the load balancer. You only have to generate it with a name consisting of the required domain name. You can do that anywhere.
吉姆，我和你有同样的问题。这是我第一次涉足 SSL 多服务器部署领域。
我发现了这个： http://www .martfox.com/customer/knowledgebase/140/Why-a-SSL-Requires-Dedicated-IP.html
看起来人们常说必须有一个静态IP地址才能运行ssl，但是看起来您确实不需要静态 IP，而需要您当时唯一使用的 IP。签署证书或创建签名请求时不需要 IP 地址。它不会以任何方式附加到您的密钥，因此您可以更改静态 IP 地址，甚至移动托管提供商，而无需重新颁发 SSL 证书。
该限制似乎是因为 VHOSTS 和其他服务器别名方法在必须连接 SSL 层之前无法访问 HTTP 请求字符串，因此它们无法像处理未经身份验证的请求一样路由它。
Jim, I had the very same question as you. This is my first foray into the realm of multi-server deployments with SSL.
I found this: http://www.martfox.com/customer/knowledgebase/140/Why-a-SSL-Requires-Dedicated-IP.html
It looks like it is commonly said that you must have a static IP address to run ssl, but it really looks like you don't need a Static IP as much as an IP that you are the only one using at the time. The IP address is not needed when signing a certificate, or creating a signing request. It is not attached to your keys in any way, so you change Static IP addresses or even move hosting providers without reissuing your SSL cert.
It appears that the limitation is because VHOSTS and other server aliasing methods don't have access to the HTTP request string before they have to connect the SSL layer, so they aren't able to route it like they do unauthenticated requests.