Two load balancers with one public IP + two types of SSL certificates (custom and automatic)

Hello,

Can I have two HTTPS load balancers sharing the same public IP but using different SSL certificate types: one HTTPS with Custom Certificate and another one HTTPS with Automatic Certificate?

I don’t have any issues with the HTTPS with Custom Certificate one, but creating the second one gives VIRTUAL_HOST_PENDING_A_RECORD message for some days.

Thank you.

Hello @Teddy_Brewski

First of all lets clarify you a speaking for XC.

Yes you can have many LBs you using the same IP

But in order to have automatic ceritificate you have to crate an A record or CNAME pointing to the F5 XCIP or URL accordingly and and another CNAME for the automatic certificate validation.

Have you created them?

Thank you @Injeyan_Kostas

Yes indeed, I’m talking about XC.

I did create an A record (tried CNAME too), but it didn’t really help.

May be I need to provide a little bit more info.

So, I have a load balancer with the Custom Certificate option selected. It has a wildcard certificate attached to it covering *.mydomain.org. No issues here -- everything works fine.

I created another load balancer and would like to use Automatic Certificate option this time. I defined one domain entry in the second load balancer: sitea.mydomain.org.  I created an A (and CNAME) entries, but VIRTUAL_HOST_PENDING_A_RECORD is still there.

I think my first load balancer takes the priority now since it has a wildcard certificate.

There is a specific CNAME for cert needed 
Have you created it?

this from my tenant
just reproduce the exact same thing

it took ~5min for the auto cert

Thank you @Injeyan_Kostas

I confirm that the CNAME and A records were created.  Unfortunately, it doesn’t seem to help in my case.

image_346093.png

Case closed -- CAA DNS entry was missing.

Thank you all!

Should I mention that I told you specifically for this record? :winking_face_with_tongue:

I thought you were referring about _acme record? :grinning_face:

My bad

Yes I was talking about acme record but after reading again you post I see it was not the case.

Actually I was not even aware of caa record.

Thank you for letting us know. I learned something today