ssl - IIS Central Cert Store - Outbound Traffic -

i have f5 load-balanced 4-server cluster environment i'm building, i'm looking centralize our certificates prevent needing install them on every server. windows 2012 / iis 8 seems have centralized certificates, secure endpoint in iis inbound traffic.

what outbound traffic? initiating tls transactions external entities, need way store these on single server , have each of iis boxes "tap into" cert store private , public keys necessary send tls message.

any suggestions?

you're looking hsm f5 support , iis supports few major vendors (thales , safe-net both have iis supported hsms). they're not cheap remember that's you're looking for.

if don't want go route, can opt dirty solution of using big-ip cert store , rely on self-signed certs on iis pool members.

inbound: incoming traffic terminates on big-ip using valid ca-signed cert ssl client profile. big-ip re-encrypts iis using generic ssl server profile. not pretty works.

outbound: have use big-ip default gateway of iis server can direct outbound tls big-ip instead of iis directly.

devcentral: ssl acceleration - can encrypt outbound traffic

hope helps.

-chase