配置具有多个域的SSL + SSL支持

Question

I am currently been involved in implementation of varnish with loadbalancer as back-end which shall forward traffic accordingly to multiple web server.

I am trying to achieve:

Public Traffic -> haproxy/DNS -> [Varnish (x2) / nginx(ssl) ] -> Loadbalancer -> Web server(x4) 

I am able to configure Varnish , nginx as ssl/443 terminator for one domain. (ie if i point dns to varnish eth and access webserver serves the page)

varnish config

backend loadbalancer { .host = "xxx.xxx.xxx.xxx"; .port = "80" } 
backend loadbalancer_ssl { .host = "xxx.xxx.xxx.xxx"; .port = "443"; }
sub vcl_recv {

                                 # Set the director to cycle between web servers.
                                  if (server.port == 443) {
                                        set req.backend = loadbalancer_ssl;
                                  }
                                  else {
                                   set req.backend = loadbalancer;
                                  }
}
# And other vcl rules for security and other.

Nginx Config

    location / {
        # Pass the request on to Varnish.
        proxy_pass  http://127.0.0.1;
            proxy_http_version 1.1;

#SSL certificate and config

=> How would i achieve configuring varnish as dns entry Point with ssl termination for multiple domains? => Is it possible to somehow configure varnish to accept all connections and bypass ssl to web server directly? (so that i don't have to worry about multiple interface for ssl support)

=> Or any standard approach to achieve with 443 terminator?

Note: why i am trying to achieve this: To create multiple layer for security and using existing hardware devices.

Already in place:

1. All server has (multiple interface for ssl using lightty).
2. Load balancer -> Hardware -> which will balance load between those web server.

Any experts sharing there view would be great.

Answer 1

I have decided to go with nginx as ssl terminator and achieving my question answers as below. I decided to update this, if anyone finds it useful.

From my above query:

How would i achieve configuring varnish as dns entry Point with ssl termination for multiple domains?

=> How it works is we need to have socket listening for https/ either nginx/pound/or anything else that can read ssl. (which i was not quite convinced previously is to use this point as ssl terminator however i think i am fine as beyond that level now i have planned to make it internal zone.

=> Is it possible to somehow configure varnish to accept all connections and bypass ssl to webserver directly? (so that i dont have to worry about multiple interface for ssl support)

One can achieve this either with multiple interface (if you have multiple domains). or, same interface if you are dealing with subdomains. Or, you can create one secure page for all ssl required pages (depends upon trade-off)

=> Or any standard approach to achieve with 443 terminator? I decided to go with nginx to use those feature that nginx provides (interms of security layer).