HTTPS - Having TLS configured on Load balancer

Question

Finally we're moving our company website from HTTP to HTTPS (because of Chrome that show a Not Secure warning for all pages served over HTTP).

In my experience I know it is better have TLS handshaking configured on load balancers, because this will remove the overhead from Web Servers.

But the person who manage the network discouraged me to configure HTTPS on load balancers because of security concerns. In a few word he explained me that have the https on our load balancers put our website in a risky position, for example we are more vulnerabile to DDOS attack.

Is this true?

What are the security drawbacks of having SSL configured directly on load balancer and what if I have SSL configured on a WebServer/Reverse Proxy?

Answer 1

I have had to architect around this problem.

TLS off-loading does put greater load on the load-balancers. Not only do they take the brunt of all the traffic, but then they have to decrypt the traffic, too. If you can do the TLS function across the distributed web server estate, you spread the load.

But this is NOT a security concern. This is a load balancer capacity concern. If your load balancers are at such a capacity that they can't handle TLS, then you are near enough to a DoS event that it might not matter. Time to consider hardware that is better designed or that can handle greater capacity.

What is a security concern is that if you keep the TLS processing on the web servers, then you cannot place other protective technology in front of your web servers and after the load balancers (like WAF or anything that needs to inspect the traffic). TLS on the load balancers means you can inspect the traffic in the clear.

As always, there is security/usability/budget balance that everyone needs to strike. If your network manager says that TLS will break the load balancers (oops), then you need to put it elsewhere.