Skip to main content

Load Balancer TLS(SSL) Certificates

To work with HTTPS traffic, you must add a TLS(SSL) certificate to the load balancer so that it can read HTTPS requests and use HTTP protocol information for proper load balancing. TLS certificate termination occurs on the load balancer, which then forwards data to servers via HTTP.

Certificates with an empty CN (Common Name) field are not supported in load balancers.

If you use a load balancer to work with a Managed Kubernetes cluster, by default the load balancer is created without a TLS (SSL) certificate, and external port 80 is assigned for receiving traffic. To create a load balancer with a TLS (SSL) certificate and assign external port 443 for receiving traffic, follow the instructions in Terminate TLS connections⁠ in the Managed Kubernetes section. For the load balancer to work properly in the cluster, all operations with the load balancer must be performed using kubectl.

The load balancer works with TLS (SSL) certificates from Certificate Manager. You can:

The certificate is added when creating a rule for HTTP or HTTPS traffic. In the control panel, you can select only one TLS (SSL) certificate for a rule. Use the OpenStack CLI if you need to add multiple certificates to a rule or add an mTLS certificate.

You can change the certificate after creating a rule:

  • replace a certificate in a load balancer rule;

  • update a custom certificate in Certificate Manager.
    Let's Encrypt® certificates issued in Certificate Manager are renewed automatically. When a certificate is renewed or updated in Certificate Manager, it is automatically updated on the load balancer. Sessions with the old certificate will be terminated and re-established with the new certificate within three hours of updating the certificate. For most protocols, re-establishing sessions is seamless for end users.

Add multiple TLS(SSL) certificates for a load balancer

  1. Upload TLS (SSL) certificates to Certificate Manager — issue Let's Encrypt® certificates or add custom ones. Certificates with an empty CN (Common Name) field are not supported in Cloud Load Balancers.

  2. Open the OpenStack CLI.

  3. Add certificates — create a new load balancer rule or update an existing one:

    openstack loadbalancer listener create \
      -v --protocol-port 443 \
      --protocol TERMINATED_HTTPS \
      --name <listener_name> \
      --default-tls-container=<certificate_uuid_1> \
      --sni-container-refs <certificate_uuid_1> <certificate_uuid_2> \
      -- <loadbalancer>

    Specify:

    • <listener_name> — rule name;
    • <certificate_uuid_1>, <certificate_uuid_2> — IDs of the certificates you added to Certificate Manager in step 1. Can be copied in the Control panel: in the top menu, click Products → Certificate Manager → in the certificate's menu, select Copy UUID;
    • <loadbalancer> — load balancer ID or name. The list can be viewed using the command openstack loadbalancer list.

Add an mTLS certificate for a load balancer

The mTLS protocol differs from TLS due to mutual authentication — when establishing a connection, both the server's authenticity and the incoming request's authenticity are verified. For this, two certificates are used in each session — for the server in the target group behind the load balancer and for the incoming request.

  1. Upload the CA certificate that will be used to authenticate incoming requests to the load balancer to Certificate Manager — add it as a custom certificate.

  2. Upload the certificate that will be used to authenticate the server in the target group behind the load balancer to Certificate Manager — issue a Let's Encrypt® certificate or add a custom certificate.

  3. Open the OpenStack CLI.

  4. Create a rule with an mTLS certificate:

    openstack loadbalancer listener create \
      -v --protocol-port 80 \
      --protocol TERMINATED_HTTPS \
      --name <listener_name> \
      --client-authentication MANDATORY \
      --client-ca-tls-container-ref <certificate_uuid_1> \
      --default-tls-container-ref <certificate_uuid_2> \
      -- <loadbalancer>

    Specify:

    • <listener_name> — rule name;
    • <certificate_uuid_1> — ID of the CA certificate you added to Certificate Manager in step 1. Can be copied in the Control panel: in the top menu, click Products → Certificate Manager → in the certificate's menu, select Copy UUID;
    • <certificate_uuid_2> — ID of the certificate you added to Certificate Manager in step 2. Can be copied in the Control panel: in the top menu, click Products → Certificate Manager → in the certificate's menu, select Copy UUID;
    • <loadbalancer> — load balancer ID or name. The list can be viewed using the command openstack loadbalancer list.

Replace a TLS(SSL) certificate in a load balancer rule

If a load balancer rule using the HTTPS protocol has a TLS(SSL) certificate that is about to expire, you can replace it by adding a different certificate with a new expiration date.

  1. Add a new custom certificate to Certificate Manager.

  2. In the Control panel, in the top menu, click Products and select Cloud Servers.

  3. Go to Load Balancers → the Load Balancers tab.

  4. Open the load balancer page.

  5. Open the rule card.

  6. In the TLS Certificate line, click .

  7. Select a new certificate. Certificates with an empty CN (Common Name) field are not supported in Cloud Load Balancers.

  8. Click .