Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have two applications: One is Backend API and the second is frontend. I want to add SSL certificate.
Both applications are visible via the Internet, one on port x (backend) and another on y (frontend). A client connects to frontend and then frontend connects to backend in order to get data.
Where should I put the certificate on the frontend or backend part?
Ideally, the connections from the Internet to your front-end and the connections from your front-end to back-end both need to be protected using SSL. Whatever is serving your front-end / back-end applications would most likely support SSL termination. Your front-end is most likely served by a web server like Nginx or Apache. You need to get the web server to listen over port 443 and setup SSL there.
If your back-end application is secure and isolated behind a firewall, and if (and only if) it's configured to receive traffic only from your front-end application, you can optionally skip setting up SSL between the applications. This is NOT recommended, however. Certificates are cheap if not free these days and you should aim to set it up wherever possible. There are even performance benefits to this and this lets you use fast, modern transport protocols like HTTP/2 or SPDY.
Depending on your setup, you could even terminate the SSL at the load balancers if you use them. May I ask why your back-end app is open to Internet?
