SSL Certificate on loadbalancer

[Thiruvarasu]

Hi Folks.We can upload  ssl certificate in 2 ways.One is on loadbalancer and one is on server.When we upload ssl in server we need to have  configuration to open 443 port in loadbalancer.Whereas while we upload ssl in loadbalancer what configuration we need to do in server end(like opening 443 port in server)?

[VannGuce]

Hi,

It depends on the server you are using. For example if your server is linux ubuntu you can use this link[1] as a guide to open ports. However, if you are talking about a GCP load balancer, once you upload or use the ssl certificate you can configure the firewall of your VPC network.

To open port 443 using a firewall you can follow this link[2] as a guide. If you are using a VM instance, upon creation, there is also an option where you can enable https (443) or http (80).

[1]https://linuxconfig.org/ubuntu-20-04-open-http-port-80-and-https-port-443-with-ufw

[2]https://cloud.google.com/firewall/docs/using-firewalls

[ShivaNaidu]

When you upload an SSL certificate directly to a load balancer, the SSL termination takes place on the load balancer itself. In this situation, the load balancer manages the SSL encryption and decryption processes. The client communicates with the load balancer using HTTPS, but the load balancer and backend servers can communicate via HTTP.

Here the thinks to need to check when uploading SSL certificates on a load balancer:

- Upload SSL Certificate on Load Balancer
- Configure Load Balancer
- Backend Server Configuration
- Security Group/Firewall Rules

By following these steps, SSL termination takes place at the load balancer, and communication between the load balancer and the backend servers is normally unencrypted. This configuration moves SSL processing away from the backend servers, making the system more scalable and efficient. It's crucial to note that the particular procedures and configuration settings may differ based on the load balancer technology you're using (for example, AWS Elastic Load Balancer, NGINX, HAProxy, etc.). Always consult your load balancer's manual for precise and detailed configuration instructions.

To know more about SSL Error you can check the "Cheap SSL Shop's Blog".