9

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject.

Assume the following example, where a intends to download a resource on the webserver (the client is not aware that an SSL terminator is installed).

Client++++++++++(SSL terminator)······Webserver

Questions:

  • Does the client establish the TCP connection to the SSL terminator or to the Webserver?
  • Does the SSL Terminator affect the TCP connection in any way?

If there is material on line explaining this, please point me to it. Thank you!

8

There are two sessions:

Client <====1====> SSL Terminator <====2====> Webserver

Each of those is a TCP session.

Session 1 is SSL-over-TCP, and session 2 is plain TCP.

SSL Terminator has dedicated hardware which speeds up the SSL encryption/decryption process (commonly 'cryption is "offloaded" to specialized cards). Because this special hardware is less easily available to use on the webserver itself, the SSL Terminator fills a niche.

Some related reading:

3

Does the client establish the TCP connection to the SSL terminator or to the Webserver?

With SSL offload enabled the client makes an SSL connection to the SSL terminator, then the unencrypted traffic is passed to the webserver from the SSL terminator. If SSL Offload is disabled the SSL traffic is passed through directly to the webserver(SSL pass-through). Also note normally the webserver is setup to run on a different port than 443 (81, 8181, 4433, etc. to an internal IP or IPs depending on your configuration).

Does the SSL Terminator affect the TCP connection in any way?

Modification of the connection depends on the configuration of the SSL terminator. Example: If you enable analytics, deep packet inspection or stripping of detected malicious data or have certain rules setup to only allow the type of traffic you want, modifications can occur before traffic is passed to the webserver or passed back to the client from the webserver or SSL terminator.

This can cause the SSL terminator to drop anything that does not meet your requirements, add special cookies for load balancing, security, inject JavaScript for analytics, or other pre-defined options you have configured. Also note, even if SSL pass-through is enabled/disabled depending on your configuration options the TCP packets may or may not be modified before being sent to the webserver.

  • 1
    Hmm... SSL terminator affects the TCP connections every time. It effectively terminates the TCP connection and opens a new one to the backend server. Hint: it's not calling "terminator" for nothing ;) – Stephane Jan 21 '15 at 7:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.