>>> Michael Ströder <michael(a)stroeder.com&gt; schrieb am 10.12.2014 um 09:44 in Nachricht <548807E4.5000108(a)stroeder.com&gt;: > Ulrich Windl wrote: >>> I use a cert with the VIP used by clients, and the hostnames used between >>> the servers all setup in the subjectaltname of the certificate. >> >> But this "solution" does not scale well when adding or removing servers... > > Why does it not scale? > > If you have an individual cert for each server with the VIP DNS name in > subjectAltName you can just add servers as needed. The point is: If you change one server, you'll have to update certificates for all active servers;

not to talk about that fact that all certificates will expire exactly at the same time.