---
title: "Load Balancer TLS(SSL) Certificates"
sidebar_label: "Load Balancer TLS(SSL) Certificates"
sidebar_position: 3
description: "Which certificates can be added to a cloud load balancer, how to add multiple TLS(SSL) certificates"
---

import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import CheckIcon from '@selectel/docux/icons/check'
import EditIcon from '@selectel/docux/icons/edit'
import MoreVerticalIcon from '@selectel/docux/icons/more-vertical'
import {TabItemLabel} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'

# Load Balancer TLS(SSL) Certificates

To work with HTTPS traffic, you must add a TLS(SSL) certificate to the load balancer so that it can read HTTPS requests and use HTTP protocol information for proper load balancing. TLS certificate termination occurs on the load balancer, which then forwards data to servers via HTTP.

Certificates with an empty `CN` (Common Name) field are not supported in load balancers.

If you use a load balancer for a Managed Kubernetes cluster, by default the load balancer is created without a TLS(SSL) certificate, and external port 80 is assigned to receive traffic. To create a load balancer with a TLS(SSL) certificate and assign external port 443 to receive traffic, use the [Terminate TLS connections](/managed-kubernetes/networks/loadbalancing-with-ingress/terminate-tls-connection.mdx) guide in the Managed Kubernetes section. For the load balancer to work correctly in the cluster, all actions with the load balancer must be performed via [kubectl](/managed-kubernetes/clusters/connect-to-cluster.mdx).

A load balancer works with TLS(SSL) certificates from the [Certificate Manager](/certificates-manager/). You can:

* [issue a free Let's Encrypt® certificate](/certificates-manager/certificates/lets-encrypt.mdx#issue-lets-encrypt-certificate), including Wildcard (for a domain and subdomains);
* [add a custom certificate](/certificates-manager/certificates/user-certificates.mdx#add-user-certificate); certificates with SAN options (one certificate for multiple domains) and Wildcard are supported.

A certificate is added when [creating a rule for HTTP or HTTPS traffic](/cloud-servers/load-balancers/rules-and-policies/create-rule-http-https.mdx). In the Control panel, you can select only one TLS(SSL) certificate for a rule. Use the OpenStack CLI if you need to [add multiple certificates to a rule](#add-certificates) or [add an mTLS certificate](#add-mtls-certificate).

You can change the certificate after creating a rule:

* [replace the certificate in a load balancer rule](#change-certificate);

* [update the user certificate in the Certificate Manager](/certificates-manager/certificates/user-certificates.mdx#update-user-certificate).<br />Let's Encrypt® certificates issued in the Certificate Manager are reissued automatically. When a certificate is reissued or updated in the manager, it will automatically update on the load balancer. Sessions with the old certificate will be terminated and re-established with the new certificate within three hours after the certificate update. For most protocols, the session re-establishment is seamless for end users.

## Add multiple TLS(SSL) certificates for a load balancer \{#add-certificates}

1. Upload TLS (SSL) certificates to the Certificate Manager — [issue Let's Encrypt® certificates](/certificates-manager/certificates/lets-encrypt.mdx#issue-lets-encrypt-certificate) or [add user certificates](/certificates-manager/certificates/user-certificates.mdx). Certificates with an empty `CN` (Common Name) field are not supported in Cloud Load Balancers.

2. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

3. Add certificates — create a new load balancer rule or update an existing one:

   <Tabs queryString="add-certificates-to-rule">
     <TabItem value="createrule" default>
       <TabItemLabel>
         Create rule
       </TabItemLabel>

       ```bash
       openstack loadbalancer listener create \
         -v --protocol-port 443 \
         --protocol TERMINATED_HTTPS \
         --name <listener_name> \
         --default-tls-container=<certificate_uuid_1> \
         --sni-container-refs <certificate_uuid_1> <certificate_uuid_2> \
         -- <loadbalancer>
       ```

       Specify:

       * `<listener_name>` — the rule name; ;
       * `<certificate_uuid_1>`, `<certificate_uuid_2>` — the IDs of the certificates you added to the Certificate Manager in step 1. You can copy them in the [Control panel](https://my.selectel.ru/certificates/): on the top menu, click **Products** → **Certificate Manager** → in the <MoreVerticalIcon /> menu of the certificate, select **Copy UUID**;
       * `<loadbalancer>` — the load balancer ID or name. You can view the list using the `openstack loadbalancer list`.
     </TabItem>

     <TabItem value="updaterule">
       <TabItemLabel>
         Update rule
       </TabItemLabel>

       ```bash
       openstack loadbalancer listener set \
         --sni-container-refs <certificate_uuid_1> <certificate_uuid_2> \
         -- <listener>
       ```

       Specify:

       * `<certificate_uuid_1>`, `<certificate_uuid_2>` — the IDs of the certificates you added to the Certificate Manager in step 1. You can copy them in the [Control panel](https://my.selectel.ru/certificates/): on the top menu, click **Products** → **Certificate Manager** → in the <MoreVerticalIcon /> menu of the certificate, select **Copy UUID**;
       * `<listener>` — the listener ID or name. You can view the list using the `openstack loadbalancer listener list`.
     </TabItem>
   </Tabs>

## Add an mTLS certificate for a load balancer \{#add-mtls-certificate}

The mTLS protocol differs from TLS due to mutual authentication — when establishing a connection, both the server's authenticity and the incoming request's authenticity are verified. For this, two certificates are used in each session — for the server in the target group behind the load balancer and for the incoming request.

1. Upload a CA certificate to the Certificate Manager to be used for authenticating incoming requests to the load balancer — [add it as a user certificate](/certificates-manager/certificates/user-certificates.mdx#add-user-certificate).

2. Upload a certificate to the Certificate Manager to be used for server authentication in the target group behind the load balancer — [issue a Let's Encrypt® certificate](/certificates-manager/certificates/lets-encrypt.mdx#issue-lets-encrypt-certificate) or [add a user certificate](/certificates-manager/certificates/user-certificates.mdx#add-user-certificate).

3. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

4. Create a rule with an mTLS certificate:

   ```bash
   openstack loadbalancer listener create \
     -v --protocol-port 80 \
     --protocol TERMINATED_HTTPS \
     --name <listener_name> \
     --client-authentication MANDATORY \
     --client-ca-tls-container-ref <certificate_uuid_1> \
     --default-tls-container-ref <certificate_uuid_2> \
     -- <loadbalancer>
   ```

   Specify:

   * `<listener_name>` — the listener name;
   * `<certificate_uuid_1>` — the ID of the CA certificate you added to the Certificate Manager in step 1. You can copy it in the [Control panel](https://my.selectel.ru/certificates/): on the top menu, click **Products** → **Certificate Manager** → in the <MoreVerticalIcon /> menu of the certificate, select **Copy UUID**;
   * `<certificate_uuid_2>` — the ID of the certificate you added to the Certificate Manager in step 2. You can copy it in the [Control panel](https://my.selectel.ru/certificates/): on the top menu, click **Products** → **Certificate Manager** → in the <MoreVerticalIcon /> menu of the certificate, select **Copy UUID**;
   * `<loadbalancer>` — the load balancer ID or name. You can view the list using the `openstack loadbalancer list`.

## Replace a TLS(SSL) certificate in a load balancer rule \{#change-certificate}

If a load balancer rule using the HTTPS protocol has a TLS(SSL) certificate that is about to expire, you can replace it by adding a different certificate with a new expiration date.

<Tabs queryString="change-certificate">
  <TabItem value="panel" default>
    <TabItemLabel>
      Control panel
    </TabItemLabel>

    1. [Add a new user certificate to the Certificate Manager](/certificates-manager/certificates/user-certificates.mdx#add-user-certificate).

    2. In the [Control panel](https://my.selectel.ru/vpc/default/lbaas/load-balancers/), on the top menu, click **Products** and select **Cloud Servers**.

    3. Go to the **Load Balancers** section → **Load Balancers \*\*\*\* tab**.

    4. Open the load balancer page.

    5. Open the rule card.

    6. In the **TLS certificate** row, click <EditIcon />.

    7. Select a new certificate. Certificates with an empty `CN` (Common Name) field are not supported in Cloud Load Balancers.

    8. Click <CheckIcon />.
  </TabItem>

  <TabItem value="openstack">
    <TabItemLabel>
      OpenStack CLI
    </TabItemLabel>

    1. [Add a new user certificate to the Certificate Manager](/certificates-manager/certificates/user-certificates.mdx#add-user-certificate).

    2. [Open the OpenStack CLI](/cloud-servers/tools/openstack-cli/).

    3. Replace the certificate in the rule:

       ```bash
       openstack loadbalancer listener set \
         --default-tls-container-ref <certificate_uuid> \
         -- <listener>
       ```

       Specify:

       * `<certificate_uuid>` — the ID of the certificate you added to the Certificate Manager in step 1. You can view it in the [Control panel](https://my.selectel.ru/certificates/): on the top menu, click **Products** → **Certificate Manager** → in the <MoreVerticalIcon /> menu of the certificate, select **Copy UUID**;
       * `<listener>` — the listener ID or name. You can view the list using the `openstack loadbalancer listener list`.
  </TabItem>
</Tabs>

<Formbricks />