2

So, after reading Wikipedia's article on reverse SSL/TLS Proxies, I totally get the advantages it offers. But doesn't it also pose a security risk, by basically being a "man in the middle"?

As a client, I cannot see whether the reverse proxies just encrypts the traffic between the client and itself and forwards all requests to the webserver over HTTP or if it does encrypt both directions.

And another question: How can an SSL-Proxy achieve to break up a requested SSL/TLS connection, without being remarked either by the user nor by the TLS webserver itself?

  • 4
    A reverse proxy is deployed with the knowledge that the network behind it is secure. Assuming that is true, then it doesn't add additional risk, or at the very least the little risk it adds is outweighed by the advantages it offers (offloading TLS to a dedicated machine possibly with hardware acceleration, etc). – André Borie Jun 28 '16 at 8:11
  • can you please elaborate on what you mean by "without being remarked either by the user nor by the TLS webserver itself?" – JOW Jun 28 '16 at 14:28
  • @AndréBorie please post answers as answers, not comments. You've basically answered the question, but now it's gone out in the newsletter as "can you answer this?" because the system doesn't know. – derobert Jun 28 '16 at 18:08
  • TLS termination proxy usually makes certificate management much easier because you only need to secure the TLS private key in one machine, instead of two hundred, if you're load balancing. – Lie Ryan Jun 29 '16 at 6:16
  • Note that not all TLS reverse proxy are TLS termination proxy. It's possible that a TLS reverse proxy just direct traffic to their destination based on SNI, but not decrypt the traffic. – Lie Ryan Jun 29 '16 at 6:18
2

In most cases in which a reverse proxy is deployed, the network behind it is assumed to be secure, in which case the fact that there is technically a man-in-the-middle is of no consequence.

However, some providers that use a reverse proxy do choose to secure the traffic behind the proxy using an IPSEC tunnel between the proxy and the content server(s). That way, the processing overhead of managing certificates, handling termination, and blocking unwanted traffic can still be done on the proxy server at the edge of the network, but a network compromise will still reveal no information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.