I need to build a failover https server.

I have: Server1 with apache, to provide https encapsulation and then 10.0.0.219 to provide docker services

I want to mirror this configuration to new "availability zone" (homemade diy), where I run apache.

Do I need to issue a new letsencrypt certificate or can I copy over the old one?

DNS will point to different availability zones.

You need to issue a new Let's Encrypt certificate for each server in a different availability zone because certificates are tied to specific domain names. Copying the old certificate won't work as it won't match the DNS records of the new server.

Let's say i have mydomain.com that points at 1.2.3.4, current site. I have a failover at 1.2.3.5. I will update mydomain.com to point to 1.2.3.5. Will browsers complain about certificate mismatch as each domain will have their own certificate?

If mydomain.com points to IP 1.2.3.5 and you haven't updated the DNS to reflect the change before switching, browsers may complain about an IP address mismatch if they attempt to connect to 1.2.3.5 using the old certificate issued for mydomain.com. However, once the DNS is updated and the browser caches the new IP, they should not complain, assuming the certificate still correctly matches mydomain.com.

For seamless operation, consider setting up: - Load Balancer: Distributes traffic between 1.2.3.4 and 1.2.3.5. - Shared Certificate: Use a wildcard certificate (e.g., *.mydomain.com) or ensure both servers use the same certificate by renewing or copying the certificate securely after validation.

After updating DNS, clear browser cache or force reload to avoid any issues due to DNS propagation delays.

How do large websites solve problems of millions computers asking load balancers where to go to? I don't believe that a single IP address handles youtube.com, for example.

Large websites like YouTube use a combination of technologies to handle millions of requests efficiently:

1. Content Delivery Network (CDN): Distributes content across a global network of servers, reducing latency and improving performance by serving content from locations closer to users.

2. Anycast Routing: Uses multiple IP addresses spread globally. Requests for a domain are routed to the nearest server based on network topology.

3. DNS Load Balancing: Utilizes DNS to direct users to different servers. Techniques like round-robin DNS or geographic DNS can distribute traffic evenly or based on location.

4. Global Load Balancers: Manage traffic across data centers around the world, ensuring high availability and reliability. These load balancers often use sophisticated algorithms to direct traffic to the best-performing servers.

5. Scaling and Redundancy: Implement horizontal scaling (adding more servers) and vertical scaling (upgrading server hardware) along with redundancy to ensure no single point of failure.

6. Infrastructure as Code (IaC): Automates infrastructure management to quickly deploy and manage large numbers of servers and services.

By combining these methods, large websites efficiently handle massive traffic while maintaining uptime and performance.

Are certificates tied to specific IP?

Certificates are not tied to specific IP addresses directly. Instead, they are issued for specific domain names (e.g., mydomain.com). When a user accesses a website using a domain name, the browser ensures that the certificate presented by the server is valid for that domain. This is done through DNS records and the certificate's Common Name (CN) or Subject Alternative Name (SAN) fields, which list the domain names the certificate is valid for.

However, if you access a website using an IP address directly, the browser will typically complain because the certificate does not match the IP address. To avoid such issues, always access services via their domain names and ensure that the DNS records point to the correct IP addresses of the servers with valid certificates.