0

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server).

I could understand that in case of HTTPS request, SSL handshake will happen, a tunnel will be created and then all the data for session would be encrypted.

But I couldn't get clear answer for below question:

  1. I am 90% sure that load balancer will not participate (or anything to do with) in SSL handshake because it is just for load balancing, so will forward to Apache based on its balancing algo. Could you please confirm?
  2. All the application resources are in Weblogic (application server), so I makes me feel that finally the encryption and SSL handshake (or tunnel) will happen from Weblogic, and it would be Weblogic which will select one of the cipher suites provides by web browser, for encryption.
    • Am I correct?
    • If yes then what would be the role of Apache in SSL handshake? Will Apache simply forward the request to Weblogic and the end-to-end tunnel will be between web browser and Weblogic?
  3. I read that maximum number of connections are controlled by Apache, so it suggests me that there would be a SSL handshake and tunnel between web browser and Apache. And if that happens then wouldn't it be overkill because there would be 2 SSL handshakes and encryption (web browser - Apache and Apache - Weblogic)?
  4. Whether Weblogic or Apache will do the cipher suite selection?
    • I could identify that for Weblogic cipher suite selection can be controlled using Dweblogic.security.SSL.Ciphersuites=TLS_RSA_WITH_AES_256_CBC_SHA256" but how it can be controlled in Apache?
  • Why do you need apache httpd? – Neil McGuigan Aug 16 '15 at 22:47
  • For creating virtual hosts is one. But thing is that it is there and it cannot be changed. – hagrawal Aug 16 '15 at 22:56
4

I think you're looking for SSL Termination, what basically happens is that the load balancer handles all the TLS/SSL process and forwards the requests to the end servers. This approach aims to streamline the implementation and management of SSL connections, imagine a load balancer serving 20 back end servers, it would require 20 machines to be able to handle connections from the same domain, and if you decide to upgrade your certificates thats a lot of work. If you however, implement it at the load balancer, all the back end servers need not to worry about this process.

Web Client --> HTTPS --> Load Balancer --> HTTP --> Backend Servers

One thing to consider is that you would be trusting that the connection between your load balancer and your back end servers is secure, which for most server schemas isn't really a problem.

Here is an article on how to implement this for NginX

  • Thank you for your inputs. I checked the SSL connectivity for environment, and communication between Apache and Weblogic is over SSL, I am completely sure about this because I checked that we are using mod_ssl module and using cipher suite as SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW. Part where I can not sure is between LB and Apache. Any idea how I can verify whether there is SSL communication between LB and Apache. – hagrawal Aug 18 '15 at 10:24
  • In either case, this is sure that LB is not doing encryption because we not installing certificates in LB. So, now how do I know that encryption is done by Apache or Weblogic, and more importantly the tunnel which is created is between web browser and LB or Apache or WL ?? – hagrawal Aug 18 '15 at 10:28
  • Most important question: Lets say web client is creating a tunnel with Apache, now since all resources are in Weblogic, so it means that there is another tunnel between Apache and weblogic. And what will happen in this case, the message which is encrypted between web client and Apache, will again be encrypted and then sent or it is first decrypted and then encrypted and sent to Weblogic? – hagrawal Aug 18 '15 at 13:00
2
  1. I’m not deeply knowledgeable about load balancing, but: depending of your load balancer, the SSL/TLS termination could or could not be managed by it.

    1. If you use HAProxy or nginx as load balancer, these one work on the Application layer/layer 7 – here TLS+HTTP – and they will handle the TLS termination, so all the TLS configuration will be there and the unencrypted requests will then be forwarded to Apache servers
    2. If you use Linux Virtual Server or any other load balancer working on the Transport layer/layer 4, the connection itself is forwarded to Apache servers, so the load balancer itself doesn’t manage the TLS termination.
  2. Since you use virtual hosting, you cannot do the (public) TLS termination in Weblogic: the HTTP protocol is encapsulated inside the TLS protocol and Apache must be aware of the selected virtual host. This is achieved with the TLS extension "Server Name Indication" (SNI), where the TLS says the name of the virtual host, in order to check the virtual host against the correct certificate. Hence Apache must open both the TLS and HTTP packets, select the virtual host and forward unencrypted packets to the application servers. Hence the TLS termination must be either on your load balancer (1.1.) or on your Apaches (2.).

  3. In the case your TLS termination is on your Apaches, you must configure it there: keys, TLS protocols and ciphers, TLS sessions, OCSP, HSTS and HPKP headers, etc. Optionally, you can connect your Apaches to your applications servers with TLS, but it is probably not needed if you operate in an internal network where you have confidence there is no eavesdropping. If you want anyway do that, you will have to configure your application servers with a TLS configuration.

  4. A good resource for TLS configuration is https://wiki.mozilla.org/Security/Server_Side_TLS. There are examples for Apache, but also general recommandations for other servers, for instance if you want to configure Weblogic to receive TLS connections.

  • Thank you for inputs. From you answer-(1.2) So mean in this case SSL termination will happen at Apache or Weblogic. Finally all my app resources are at Weblogic and this is what is confusing me that tunnel or SSL termination will be between web client and Apache OR web client and WL?? (2.) I am really novice to all this, could you please elaborate. I think there is SSL termination at WL as well because when I access application directly hitting WL then there is a tunnel created, as I check in Fiddler. (3.) Resource you provided in #4 will help on how to check SSL termination is Apache, right? – hagrawal Aug 18 '15 at 10:37
  • (3.) I think Apache and WL are connected over SSL because I checked that we are using mod_ssl module and using cipher suite as SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW. (4.) Thanks you. – hagrawal Aug 18 '15 at 10:38
  • Most important question: Lets say web client is creating a tunnel with Apache, now since all resources are in Weblogic, so it means that there is another tunnel between Apache and weblogic. And what will happen in this case, the message which is encrypted between web client and Apache, will again be encrypted and then sent or it is first decrypted and then encrypted and sent to Weblogic? – hagrawal Aug 18 '15 at 13:00
  • In order to answer to your questions, some additionnal details are needed: a. what is the size of your audience? (big audience=scenario 1.1/answer by Purefan; bigger audience=scenario 1.2). b. The classical architecture is to 'offload SSL' at Apache, not at Weblogic (backend server), else your Apache is useless and it would be more efficient to drop it, so the question: what is the aim of Apache if your Weblogic can speak HTTP(S)? c. Don’t speak about "tunnel" without further precision, but speak about the various treatments you do at each step by refering to the protocol in the OSI model. – Seb35 Aug 26 '15 at 10:06
  • Thank you for inputs. #1.2 is our case. If communication between Apache and WL is over HTTP then it would go unencrypted and hence would be vulnerable. Tunnel is created between web client and Apache, can be easily using any web debugger tools like fiddler. I am not completely sure about in case of SSL communication between Apache and WL as well there would be a tunnel created. – hagrawal Aug 26 '15 at 10:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.