The scenario is that a client browser (eg: a user trying to log in to a bank website) needs to be able to view certain sensitive information that resides in a mainframe sitting in the Internal network via a web/application server that resides in the DMZ (The client should not be able to directly connect to the mainframe).
In a simple setting, there will be two TLS sessions i.e. one between the client and the web server & the second would be between the webserver and the mainframe. The problem with this setting is that the sensitive information is getting decrypted and encrypted again at the webserver. So there will be a point in time when the sensitive information is in the clear on the web server.
How can I mitigate this such that the information remains confidential at the web server but can be decrypted successfully at the client's end? How can I achieve this end-to-end encryption?