4 ms·
If your load balancers are AWS load balancers, you are doing it wrong. AWS provides their own free certificates that work the load balancer and they handle rene
by markstos 7y ago
If your load balancers are AWS load balancers, you are doing it wrong. AWS provides their own free certificates that work the load balancer and they handle renewal as well. Let's Encrypt would be an unnecessary additional dependency and complexity.
(At least if you are comfortable terminating your SSL at the load balancer. If you plan to use SSL between the AWS LBs and your EC2 instances, then AWS certs don't work there and you'll need to provision them yourself using something like LE).
- owenmarshall 7y ago> (At least if you are comfortable terminating your SSL at the load balancer. If you plan to use SSL between the AWS LBs and your EC2 instances, then AWS certs don't work there and you'll need to provision them yourself using something like LE). Interesting note - ALBs/ELBs (NLBs with SSL termination as well, I would assume, but I am not sure) do not perform validation of your backend certificate. You can terminate at the load balancer and use an expired self signed SHA1 cert for all AWS cares.
- abofh 7y agoElbs do support public key verification of the backends (search for Enable backend authentication). I believe you are correct wrt Albs and nlbs, and in neither case does it check the cert ttbomlk, just the public key.
- manishsharan 7y agoI stopped using AWS load balancer as I found that it was costing me more than my server, which are cheap as I normally use a fleet of spot instances . Also this is not corporate funded but my own money -- so I am very cost sensitive