SSL Certificate in Load Balancing

Posted on January 15, 2020

High Availability

Ubuntu 18.04

Apache

Load Balancing

By Flávio Tomazio

I am looking to create some load balancing servers with high availability.

Following this model: How To Set Up Highly Available HAProxy Servers with Keepalived and Floating IPs on Ubuntu 14.04

As I have no experience with this type of configuration, are the security certificates and Apache installed on the load balancing server or only on the servers containing the application?

I considered using DigitalOcean’s native load balancing service, but as I specifically need multiple security certificates and our own, I couldn’t use it.

Another hardware issue, do these balancing servers need to have more RAM or CPU?

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Bobby

June 12, 2023

Hi there,

What I personally do is to do the SSL termination the Load Balancer. In this case, the load balancer handles the encryption and decryption of traffic, meaning it needs access to the SSL/TLS certificates. The connection between the load balancer and the backend servers can go over a DigitalOcean VPC and can be unencrypted, which reduces the load on the backend servers but may not be suitable if you need end-to-end encryption.

In terms of hardware requirements for the load balancers, if you’re terminating SSL at the load balancer, you’ll need enough CPU power to handle the encryption and decryption of traffic. The amount of RAM needed will depend on the number of concurrent connections your load balancer has to handle. But in general, HAProxy is very efficient and should require fewer resources than our web servers.

Best,

Bobby