meusparabens Wrote: Bad: * Difficult in multi/load-balanced setup
I think that is pretty easy to solve: you install the certificate on the load balancer. If the actual instances are in the same private network as the load balancer they could communicate unencrypted. If not they can use certificates for their instance specific hostnames.