Self signed & CA signed certificate

Question

Hi Experts,
Please consider below scenario.
users -
>Outer Firewall----.Portal with static content ->Cisco load balancer ->Inner Firewall>Apache>Web dispatcher-->SRM Portal with dialog instances -
> SAP SRM -
>Backend.
Here user will directly hit Cisco load balancer ( public IP ) So we will be installing CA signed certificate from vendor like Verisgn , Entrust etc.
But at Apache server ( private IP ) , do we really require  CA signed certificate from vendor like Verisgn , Entrust etc.
I mean even if we install self signed certificate at Apache it will do encryption & decryption . Also user will  not directly access Apache. so they will not see warning  messages.
So as  self signed certificate will do encrytion & decrytion , do we really require  CA signed certificate from vendor like Verisgn , Entrust etc  at Apache?
Best Regards,
Tushar.
Edited by: TChavan on Jan 7, 2011 1:18 PM

Answer 1

Quoting myself again , in [this thread|SSL Setup in a load balanced portal; I wrote: You probably don't need a signed cert on the portal (Apache in your case) server itself (depending on whether your LB validates the cert). You could just use the default self-signed cert, since users won't be connecting to it directly and so won't be troubled by warnings about untrusted certs: the traffic from the AS would still be encrypted, you would only lose out on the server authentication feature (which you don't need, since again users won't see it).
Regards,
Sean