SQL TLS termination on Load Balancer

Question

From what I understood TLS is protocol independent of HTTPS and can be used with other protocols as well. For example in order to connect to MS SQL server via encrypted connection I'll have to enable TLS with cert on MS SQL server and I know that works.

My question is why it's not possible to leave MS SQL server without TLS configuration and put TLS termination on Load Balancer such as AWS NLB using TCP (TLS) listener that will just forward traffic after decrypting TCP packets to MS SQL server? What am I getting wrong in whole this TLS termination offloading to LB approach?

Answer 1

You really, REALLY shouldn't be exposing your database server to the Internet, no matter how good of a password you have on it. Keep that sort of thing entirely within the cluster; doing otherwise is just additional attack surface you don't need or want. With that said, the basic principle you describe - terminating TLS at the load balancer, which effectively acts as a reverse proxy for the DB server - is totally viable.

Obviously, the load balancer would need a suitable and trusted certificate for each backend server (and corresponding private key) or the client will reject the TLS handshake as untrusted. Additionally, it's not a good practice to use plain-text communication even within your network; defense in depth dictates that you should re-encrypt the traffic between the load balancer and back-end servers (ideally with per-server mutual TLS keys) so that an attacker who is able to monitor, intercept, or generate traffic within the cluster (perhaps by SSRF or by compromising one server) can't fully compromise the network (or at least it's not easy, and gives more time for defense).