|
> Intel used to make a daisy-chain network device that would do this. A lot
> of
> companies still add an SSL card to a few servers, e.g.
> http://h18004.www1.hp.com/products/servers/security/axl600l/ or
> http://www.chipsign.com/modex_7000.htm. And then there are the
> accelerators
> on F5s and their like. I think the least disruptive way will be the
> add-on-card to two servers and a :443 vip containing only them.
>
I haven't tried this with LVS - but I see no reason why this wouldn't
work. You could use a secure content accelerator like the Cisco SCA1/SCA2.
These could sit between your client and LVS (transparently) or you could
create a server farm of SCAs for high availablity. This means that your
web servers would see the requests unencryted (still secured though) so
this means they wouldn't take a performance hit.
Just my $0.02
|
