将NGINX用作RAILS应用程序的负载平衡器时，哪些SSL证书

Question

I have a rails app (3.2.x) https://myapp.com (ficticious name) using Nginx as the webserver, one server running the whole software stack. Notice the https, I have a valid SSL certificate installed.

With increase in traffic I want to add a loadbalancer infront of the application, so the idea is to have:

1 loadbalancer (using Nginx)
4 app servers (running the RubOnRails / Nginx)
1 DB server

With the servernames being

lb.myapp.com
app1.myapp.com, app2.myapp.com, app3.myapp.com, app4.myapp.com
db.myapp.com

I want to keep the SSL processing on the app server level (as I cant necessarily trust the network traffic between the loadbalancer and the app servers).

1. Is it correct to put the server name app1.myapp.com (respectively) into the server_name config parameter of each of the app servers, and lb.myapp.com in the server_config parameter of the loadbalancer?

2. Do I assume correct that I dont have to set the ssl_on, ssl_certificate and ssl_certificate_key config parameters set in the loadbalancer but only on the app servers (which are supposed to handle the SSL part)? I would only add

    proxy_set_header X-FORWARDED-PROTO https; proxy_redirect off; 

   to the load balancer?

3. What SSL certiciates do I need, is it just the one myapp.com or do I need to have different ones for the different app servers?

Answer 1

1. that only matters if your app server serves multiple site depending on the HOST value.
2. Wrong assumption. Your proposed setup implies SSL termination is done on the nginx loadbalancer. This means your myapp.com SSL certificate should be configured on the loadbalancer.
3. You pointed out you do not trust the connection between loadbalancer and the app servers. You can solve this on different levels. Some solutions are (assuming SSL termination at loadbalancer):
   • https to the app servers (your own suggestion), for this you need myapp.com + (self signed) app server SSL certificates.
   • VPN beteen loadbalancer and app servers

A different approach is to do SSL termination at the app servers. This can be achieved with eg HAProxy ( http://haproxy.1wt.eu/ ). There are some caveats with this approach like: all connections to your app servers will have as origin the loadbalancer.