We have a website hosted behind WAF and we will be using HTTPS. The server already has a valid SSL. Do we need to install SSL on WAF servers also?


A WAF applies filter rules on traffic at an "application" level (e.g. it tries to detect SQL injection attempts). This requires that the WAF sees the traffic, i.e. whatever SSL which may have happened on the client side must stop at the WAF. But you usually want some SSL to protect the traffic between the client and the WAF (in fact, you usually want it more on that link than between the WAF and the server itself, since WAF and server are usually nearby to each other).

There are two ways for a WAF to see SSL-protected traffic:

  • The WAF has a copy of the private key used by the (SSL-aware) server, and thus can decrypt the data as it flows. (This can imply some restrictions on the cipher suites used by the server; namely, no DHE).

  • The WAF itself runs a SSL server, and that is the one which the client sees. The WAF decrypt the data, runs its magic on it, and then forwards it to the server over a new connection which may or may not be SSL-protected.

Which one you use depends on what your WAF instance can do and how you configured it.

  • Hi , my website requires https connection right from the client ie users browser to the destination server via WAF. I have SSL in destination server. Is it required to install SSL on the WAF layer or I can continue without SSL ? – Arun Oct 28 '13 at 18:55
  • If you want to prevent MITM attacks between the WAF and the destination server (you know, as a defense-in-depth strategy just in case the network has been breached somehow), then yes you should. The good news is, you can now use self-signed certificates for this SSL communication, since WAF-destination server communications are supposedly internal network only. – Nasrus Nov 4 '13 at 2:17
  • You will also need to install SSL on the WAF so it can present a valid (ie. signed by a commercial cert authority) cert to the client and inspect the traffic between client and destination server. Basically, see @Tom Leek's second point. – Nasrus Nov 4 '13 at 2:22


Either way, the SSL certificate will need to be installed on the WAF in order for it to inspect the encrypted traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.