0

I have two applications: One is Backend API and the second is frontend. I want to add SSL certificate.

Both applications are visible via the Internet, one on port x (backend) and another on y (frontend). A client connects to frontend and then frontend connects to backend in order to get data.

Where should I put the certificate on the frontend or backend part?

1
  • What are the domain names? I.e are they subdomained? I would put it on both if they are living on the same parent domain. Defiantly on the one the client is connecting to (the frontend).
    – Trickycm
    Sep 12 '17 at 13:01
4

Ideally, the connections from the Internet to your front-end and the connections from your front-end to back-end both need to be protected using SSL. Whatever is serving your front-end / back-end applications would most likely support SSL termination. Your front-end is most likely served by a web server like Nginx or Apache. You need to get the web server to listen over port 443 and setup SSL there.

If your back-end application is secure and isolated behind a firewall, and if (and only if) it's configured to receive traffic only from your front-end application, you can optionally skip setting up SSL between the applications. This is NOT recommended, however. Certificates are cheap if not free these days and you should aim to set it up wherever possible. There are even performance benefits to this and this lets you use fast, modern transport protocols like HTTP/2 or SPDY.

Depending on your setup, you could even terminate the SSL at the load balancers if you use them. May I ask why your back-end app is open to Internet?

2
  • Currently, my backend app is not open to the Internet. I still must configure it. There is no need to put my back-end app open to the Internet.
    – trojek
    Sep 12 '17 at 15:14
  • Right. I asked because you said "Both applications are visible via the Internet" and I mistook it to have meant that the back-end is openly accessible from the Internet. Hope my answer helped. Sep 13 '17 at 3:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.