SSL Setup in a load balanced portal

Question

Hi,
We are implementing a portal landscape and also we are using a hardware based (Cisco ACE) load balancer for load balancing purposes.
So the configuration would be:
Portal requests --> Load Balancer --> Portal --> Backend
We are trying to implement SSL until the portal server and I have a question regarding the SSL certificate installation process.
The URL on the load balancer would be for example https://portaltest.mycompany.com which would load balance the requests between the application servers of the portal (https://sapeptest1.mycompany.com:50001/irj/portal and https://sapeptest2.mycompany.com:50001/irj/portal).
So, first thing we will have to do would be to install an SSL certificate (signed by a Trusted CA) on the load balancer with a CN=portaltest.mycompany.com.
I understand that for https to function properly, the host name in the URL we are using to get to the server should match the CN of the SSL certificate installed on the server.
Now, can we install the same certificate (that we put on the LB) on the portal as well?
(This might not work because the server type will be different)
(or)
Do we need to buy 2 certificates with the same CN and install one each on the LB and portal ?
Can some one please suggest on how to proceed with the SSL setup and certificate installation process ?
Thank You ,
Raj

Answer 1

Raj Kumar wrote:
My question is about how to go about installing the certificates on the LB and on the portal.
If you aren't using web dispatcher, then the details of the installation on the LB will depend on your LB (Cisco? Radware? etc?). I suggest contacting your LB vendor for that.
Sen's link is for SSO, you want the [SSL procedure|http://help.sap.com/saphelp_nw70/helpdata/en/f1/2de3be0382df45a398d3f9fb86a36a/frameset.htm].
You probably don't need a signed cert on the portal server itself (depending on whether your LB validates the cert). You could just use the default self-signed cert, since users won't be connecting to it directly and so won't be troubled by warnings about untrusted certs: the traffic from the AS would still be encrypted, you would only lose out on the server authentication feature (which you don't need, since again users won't see it).
On the other hand, do you really need SSL on portal server? That adds overhead at both the LB and portal. It's usually sufficient to use HTTP from the LB to the back-end, as long as the servers only allow connections from the LB. I realize you aren't using web dispatcher, but this looks like scenario #3 in [this diagram|http://help.sap.com/saphelp_nw70/helpdata/en/d8/a922d7f45f11d5996e00508b5d5211/frameset.htm]
Regards,
Sean