Using mruby, ngx_mruby and redis - Applying on current production server

Question

I am very afraid of making some modifications on the server. Because the server is working fine with the current settings.

I will to explain: The server is an Amazon EC2 instance. In this instance I have:

ruby -v: ruby 2.2.2p95 (2015-04-13 revision 50295) [x86_64-linux]
rails -v: Rails 4.2.3
nginx -v: nginx/1.8.0
passenger -v: Phusion Passenger version 5.0.10

I have 1 Load Balancer, which has a listner:

Load Balancer Protocol: HTTPS
Load Balancer Port: 443
Instance Protocol: HTTP
Instance Port: 80
SSL Certificate: Using a certificate issued on Amazon Certificate Manager. I have the domain and all sub-domains (wildcard).

This settings allow me to:

• Have the main domain to the app:

  • www.testname.com and testname.com to use as institutional pages (About, Price, Terms etc.);
  • app.testname.com for users to use the system;

• Have how many subdomains I want, because EACH USER has an specific page:

  • user1.testname.com
  • user2.testname.com
  • user3.testname.com
  • etc.

All work is dynamic. The user registers on the app and has a subdomain. In this subdomain, the user can access via https://. It works fine.

Users WANT to use their own domain, off course. This part is easily resolved. I create a CNAME record in the custom domain, pointing to the our subdomain, like that:

usercustomname.com    CNAME TO    user1.testname.com

It works fine. BUT, the big problem is: 'https://' not working on its custom domain name, obviously. Our certificate allows the domain testname.com and its subdomains.

With Amazon Certificate Manger I can import custom certificates. And then, using the awesome rails-letsencrypt gem, I can generate Let's Encrypt certificates to the custom domain names.

But the Amazon Load Balancer, in the https listner, allow to use only 1 certificate! This is very bad, because I can to have a lot of certificates, but using only one in the whole server.

Recently, Amazon releases multiple certificates to Application Load Balancer using SNI. I can to migrate my Classic Load Balancer to the Application Load Balancer, but this not solves the problem, because the max certificates limit is 25 per Load Balancer. Is very low.

The solution I found is to create an Amazon Elasticache to run a REDIS server. And then, using ngx_mruby to get the certificate. I plan it like that:

• Change the https listner like that:

  • Instance Protocol: HTTPS
  • Instance Port: 443
  • Remove the certificate issued in Amazon Certificate Manger

• Install mruby

• Install ngx_mruby
• Using rails-letsencrypt gem, create 1 certificate for each institutional subdomain (app, www, empty subdomain) AND create 1 certificate for each user subdomain.

When a certificate is created, the rails-letsencrypt gem can save the certificate in REDIS.

Using ngx_mruby, listen the port 443, the certificate for the domain is picked up on redis.

Apparently, this will work. The logic seems right but I do not know in practice.

My questions are:

1) To install mruby, I will follow these steps. After install, will impact in the current ruby installation? Will I need to change the system code already developed as a mruby installation result?

2) Using REDIS will affect something in the current server? Despite the $ 12/month increase in Amazon's account, I believe that using REDIS will not influence the current server at all.

3) Do you think that what I planned to solve the Amazon certificate limit will works?

Sorry the big text. I'm not server specialist. This is the unique server I have, AND without backup. And I'm afraid to break the server with no way to fix.

Tks and I appreciate any help :)