We use the ACE too. We have (2) WFE(s) and (1) INDEX server that is running the
CA. The ACE controls which box is in the pool. Basically, we have two IP(s) on
each physical WFE server. The default IP is assigned to the FQDN. The other IP
is bound to the web application.
On the CA side, we have:
(under the Internal URL)
http://servername1/ ---> (zone) Default ---> (public url)
https://domain.ufl.edu/
http://servername2/ ---> (zone) Default ---> (public url)
https://domain.ufl.edu/
https://domain.ufl.edu/ ---> (zone) Default ---> (public url)
https://domain.ufl.edu/
http://domain.ufl.edu/ ---> (zone) Default ---> (public url)
https://domain.ufl.edu/
Finally, we have a test page that the ACE checks for in SP. If it does not come
back with a favorable "200" response it takes that server out of the pool. The
ACE also controls the HTTPS. So, no cert configured on the CA side.
I don't know if this is correct or best practice but it does work for us.