A single Load Balancer supports multiple TLS (Transport Layer Security) certificates, enabling several secure websites on one IP address. The Load Balancer selects the correct certificate based on the requested domain name.
## SNI certificate selectionLoad balancer listeners support the Server Name Indication (SNI) extension to handle multiple TLS certificates. Based on the SNI information provided by the client, the listener selects the appropriate TLS certificate to encrypt the connection. Once the TLS connection is terminated at the listener, the Load Balancer inspects the decrypted traffic and routes it to the proper server.
Each listener supports its own TLS certificate, mapped to a specific hostname or domain.
## Multiple TLS certificatesListeners using the Terminated HTTPS and Prometheus protocols support multiple TLS certificates.
### Step 1. Add certificates to Secrets ManagerAdd the required certificates to Gcore Secrets Manager. If no certificates exist yet, the [upload guide](/cloud/secrets-manager/upload-a-pkcs12-file) covers PKCS12 configuration for HTTPS Load Balancers.
### Step 2. Add certificates to a listenerAfter uploading the certificates, add them to a listener — during Load Balancer creation or from the settings of an existing one.
Create a new Load Balancer following the [setup guide](/cloud/networking/create-and-configure-a-load-balancer). In step 5, configure the listener as follows:
1. Enter a name for the listener. 2. Select a protocol with the supported TLS encryption: **Terminated HTTPS** or **Prometheus**. 3. Use a default port or specify a custom port from 1 to 65535. 4. (Optional) To identify the origin of the user's IP address connecting to a web server via a Load Balancer, enable the **Add headers X-Forwarded-For, X-Forwarded-Port, X-Forwarded-Proto to requests** toggle. 5. Select the **Default TLS Certificate** — the certificate used when no SNI-matching certificate is configured for the requested domain. 6. Select the SNI Certificates stored in Secrets Manager. 7. Set the **Connection limit** — the maximum number of simultaneous connections the listener can handle. 8. (Optional) In the **Allowed CIDRs** field, specify the IP addresses allowed to access the content. The load balancer blocks requests from any IP outside the specified range. 9. (Optional) Configure basic authentication for HTTP traffic to restrict unauthorized access. Click **Add user** and specify the following credentials: * **Enter username**: the username required to access the resource. * **Password**: specify a plain-text password or provide an encrypted password. 10. Click **Create Listener**.
To add TLS termination to an existing Load Balancer without creating a new one, update it as follows:
1. In the [Gcore Customer Portal](https://portal.gcore.com), navigate to the **Cloud** page and click **Networking**. 2. Open the **Load Balancers** page.
3. Find the Load Balancer to configure and click its name to open it.
4. Navigate to the **Listeners** tab and click **Add Listener**.
5. To configure the listener, follow the same steps as in the **During Load Balancer creation** tab.
When configuring basic authentication, specify an encrypted password instead of plain text. To generate a hash using the [MKPasswd](https://www.unix.com/man-page/linux/1/mkpasswd/) utility:
1. Check the available encryption types: ```sh theme={null} docker run --rm yardalgedal/mkpasswd -m help ``` 2. Select an encryption method and generate the password hash. To create a bcrypt hash, run: ```sh theme={null} docker run --rm yardalgedal/mkpasswd -m bcrypt mypassword ``` 3. Insert the hash into the **Encrypted password** field:
Steps 1–4 below upload a certificate to Secrets Manager, list existing certificates, attach the certificate to a new listener, and add SNI certificates for multi-domain support.
GET /cloud/v1/tasks/{task_id} every 5 seconds until `state` is `FINISHED`:
```bash theme={null}
curl "https://api.gcore.com/cloud/v1/tasks/$TASK_ID" \
-H "Authorization: APIKey $GCORE_API_KEY"
```
When complete:
```json theme={null}
{
"state": "FINISHED",
"created_resources": {
"secrets": ["04c518a0-738e-4fc6-b045-32a779ef83b3"] // save as SECRET_ID
}
}
```
Configure TLS termination on a listener by attaching certificates via `sni_secret_id` on [`gcore_cloud_load_balancer_listener`](https://registry.terraform.io/providers/G-Core/gcore/latest/docs/resources/cloud_load_balancer_listener).
Specify the default certificate in `secret_id` — the fallback used when no SNI certificate matches the requested domain. Pass `""` to omit the default; connections without a matching SNI certificate will fail. Add one or more SNI certificates in `sni_secret_id`; the load balancer matches the client's requested hostname against the Subject Alternative Names of each SNI certificate.
```hcl theme={null} resource "gcore_cloud_secret" "tls" { project_id = var.project_id region_id = var.region_id name = "example-com-cert" payload_wo_version = 1 payload = { certificate_wo = file("${path.module}/certificate.pem") private_key_wo = file("${path.module}/private_key.pem") certificate_chain_wo = file("${path.module}/certificate_chain.pem") } } resource "gcore_cloud_load_balancer_listener" "https" { project_id = var.project_id region_id = var.region_id load_balancer_id = var.load_balancer_id name = "https-listener" protocol = "TERMINATED_HTTPS" protocol_port = 443 secret_id = "" sni_secret_id = [gcore_cloud_secret.tls.id] } output "listener_id" { value = gcore_cloud_load_balancer_listener.https.id } ```Set `var.load_balancer_id` to the ID of an existing [load balancer](/cloud/networking/create-and-configure-a-load-balancer).
## Additional SNI certificatesPass all certificate IDs together — `sni_secret_id` replaces the full list on each apply:
```hcl theme={null} resource "gcore_cloud_secret" "sni_extra" { project_id = var.project_id region_id = var.region_id name = "extra-domain-cert" payload_wo_version = 1 payload = { certificate_wo = file("${path.module}/extra-certificate.pem") private_key_wo = file("${path.module}/extra-private_key.pem") certificate_chain_wo = file("${path.module}/extra-certificate_chain.pem") } } resource "gcore_cloud_load_balancer_listener" "https" { ... sni_secret_id = [ gcore_cloud_secret.tls.id, gcore_cloud_secret.sni_extra.id, ] } ``` ## Certificate rotationTo replace a certificate, increment `payload_wo_version` on the corresponding `gcore_cloud_secret` resource — Terraform destroys the old secret and creates a new one. The listener re-reads the new ID via the reference.
Remove the listener block first, then the secret blocks, and run `terraform apply` — Terraform deletes the listener before the secrets to satisfy the API constraint that a secret in use cannot be deleted.
```hcl theme={null} # Step 1: comment out or remove the listener block and apply # resource "gcore_cloud_load_balancer_listener" "https" { ... } # Step 2: after the listener is gone, comment out or remove the secret blocks and apply # resource "gcore_cloud_secret" "tls" { ... } # resource "gcore_cloud_secret" "sni_extra" { ... } ``` ## ImportTo bring an existing listener under Terraform management:
```bash theme={null} terraform import gcore_cloud_load_balancer_listener.https '{PROJECT_ID}/{REGION_ID}/{LISTENER_ID}' ```