0

I'm running several e-commerce websites, each is processed by the same php code which loads different configuration based on the domain that it is being accessed from.

I'm trying to use OpsWorks to make scaling easier but I've run into a roadblock, a layer can only have 1 ELB attached to it. Since each site has its own SSL certificate I'm not sure how I can use the same set of servers to handle multiple ssl enabled domains under OpsWorks?

James
  • 173
  • 4
  • https://en.wikipedia.org/wiki/Server_Name_Indication perhaps, if you can ditch WinXP users. – ceejayoz Jul 01 '15 at 13:35
  • @ceejayoz, Thanks for the feedback but I've already considered using SNI but since it would prevent anyone using IE on WinXP from visiting the site (which I believe is still quite a large base), its not really practical for an e-commerce platform. – James Jul 01 '15 at 15:04
  • It's only still large in China. The rest of the world has pretty much ditched XP, or at least runs something other than Internet Explorer. They've had to, as it is no longer possible to create a secure SSL configuration that works with IE on XP, even without SNI. – Michael Hampton Jul 01 '15 at 18:43

1 Answers1

0

There are 2 ways you can go about dealing with this. The first is by use of an Application Load Balancer, but as you've mentioned in your comments you don't want the risk of going down the SNI route in case it blocks customers - which is fine, Opsworks doesn't "officially" support these right now anyway (there's a recipe to make them work, but I've not tried it).

The second way, and is a route I'm currently going down myself, is to use a single Classic ELB (as you are now), and using Amazon's Certificate Manager to create a single SSL certificate with multiple domain names. ACM is free to use and it should be fit for your purpose.

Use the ACM console to request a new certificate. Enter as many domains as you need to have on it, then go through the verification process for each one (it sends postmaster/hostmaster/admin of each domain an email with a link to click on). Once you've done this and the certificate is issued, associate it to your HTTPS listener on your ELB. Once you've done this, your ELB will be able to serve traffic for all the given domains without the use of SNI.

dannosaur
  • 953
  • 5
  • 15