I need to set up SSL on my network for our web sites.

I have stand alone SSL servers which sit at the top of the network, intercepting SSL connections which offload the web servers.

My question is, should I use the SSL server or, if I use SSL on the web servers, will I need an SSL cert on every web server?

Mike

well you've said nothing about what these ssl servers are. I manage a number of F5 LTM's, which are just about *the* top end for dedicated ssl offload, and if you have a device as good as that, with physical SSL offload hardware, then use them if you can, absolutely. your cert only needs to exist on the device doing the SSL, so if that's on offload engine, that's one place, if it's 10 phsyical servers, that's 10 copies... it depends a lot on how SSL is used though in relation to the application. if the web app itself is controlling the bounce up to https from http based on various parameters, then that can be very tricky to extract from the app to an engine, but if it's an all or nothing thing it should be very simple.

>well you've said nothing about what these ssl servers are.

Sorry for the lack of reply, I never received anything showing a reply to this thread.

The hardware is Lucent, I don't have the model number handy but can get it. They handle about 200 sessions each and can be chained. I have several of them. Hardware is not much of a problem though, I can get what ever I need pretty much.

>offload hardware, then use them if you can, absolutely. your cert only >needs to exist on the device doing the SSL, so if that's on offload
>engine, that's one place, if it's 10 phsyical servers, that's 10 >copies... it depends a lot on how SSL is used though in relation to the >application.

Right, so if I use multiple SSL servers, then I need certs on each one.

>if the web app itself is controlling the bounce up to https from http >based on various parameters, then that can be very tricky to extract
>from the app to an engine, but if it's an all or nothing thing it
>should be very simple.

Well, I've had these things sitting here for some time and would like to put them to some good use. Plus, it would offload the servers anyhow which is always good.

But since I've not used them, I was/am not sure about some things, you know, if things get weird or complicated when using external SSL servers like this.

Mike