Lowest-tech solution:
shuffle the ads into 5 directories. Get the first block on the page out of the first dir and so on.

Have a cron-job either rename the dirs in a round-robin fashion or shuffle the adds between the dirs every 15 minutes. This makes sure that in the long run all the ads have equal chance to show up.

BUT: Both would need a locking mechanism, so that the SSL is not accessing at the moment of the renaming or shuffling.