Encryption in case of distributed architecture

Question

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server).

I could understand that in case of HTTPS request, SSL handshake will happen, a tunnel will be created and then all the data for session would be encrypted.

But I couldn't get clear answer for below question:

1. I am 90% sure that load balancer will not participate (or anything to do with) in SSL handshake because it is just for load balancing, so will forward to Apache based on its balancing algo. Could you please confirm?
2. All the application resources are in Weblogic (application server), so I makes me feel that finally the encryption and SSL handshake (or tunnel) will happen from Weblogic, and it would be Weblogic which will select one of the cipher suites provides by web browser, for encryption.
   • Am I correct?
   • If yes then what would be the role of Apache in SSL handshake? Will Apache simply forward the request to Weblogic and the end-to-end tunnel will be between web browser and Weblogic?
3. I read that maximum number of connections are controlled by Apache, so it suggests me that there would be a SSL handshake and tunnel between web browser and Apache. And if that happens then wouldn't it be overkill because there would be 2 SSL handshakes and encryption (web browser - Apache and Apache - Weblogic)?
4. Whether Weblogic or Apache will do the cipher suite selection?
   • I could identify that for Weblogic cipher suite selection can be controlled using Dweblogic.security.SSL.Ciphersuites=TLS_RSA_WITH_AES_256_CBC_SHA256" but how it can be controlled in Apache?

Answer 1

I think you're looking for SSL Termination, what basically happens is that the load balancer handles all the TLS/SSL process and forwards the requests to the end servers. This approach aims to streamline the implementation and management of SSL connections, imagine a load balancer serving 20 back end servers, it would require 20 machines to be able to handle connections from the same domain, and if you decide to upgrade your certificates thats a lot of work. If you however, implement it at the load balancer, all the back end servers need not to worry about this process.

Web Client --> HTTPS --> Load Balancer --> HTTP --> Backend Servers

One thing to consider is that you would be trusting that the connection between your load balancer and your back end servers is secure, which for most server schemas isn't really a problem.

Here is an article on how to implement this for NginX

Answer 2

1. I’m not deeply knowledgeable about load balancing, but: depending of your load balancer, the SSL/TLS termination could or could not be managed by it.

   1. If you use HAProxy or nginx as load balancer, these one work on the Application layer/layer 7 – here TLS+HTTP – and they will handle the TLS termination, so all the TLS configuration will be there and the unencrypted requests will then be forwarded to Apache servers
   2. If you use Linux Virtual Server or any other load balancer working on the Transport layer/layer 4, the connection itself is forwarded to Apache servers, so the load balancer itself doesn’t manage the TLS termination.

2. Since you use virtual hosting, you cannot do the (public) TLS termination in Weblogic: the HTTP protocol is encapsulated inside the TLS protocol and Apache must be aware of the selected virtual host. This is achieved with the TLS extension "Server Name Indication" (SNI), where the TLS says the name of the virtual host, in order to check the virtual host against the correct certificate. Hence Apache must open both the TLS and HTTP packets, select the virtual host and forward unencrypted packets to the application servers. Hence the TLS termination must be either on your load balancer (1.1.) or on your Apaches (2.).

3. In the case your TLS termination is on your Apaches, you must configure it there: keys, TLS protocols and ciphers, TLS sessions, OCSP, HSTS and HPKP headers, etc. Optionally, you can connect your Apaches to your applications servers with TLS, but it is probably not needed if you operate in an internal network where you have confidence there is no eavesdropping. If you want anyway do that, you will have to configure your application servers with a TLS configuration.

4. A good resource for TLS configuration is https://wiki.mozilla.org/Security/Server_Side_TLS. There are examples for Apache, but also general recommandations for other servers, for instance if you want to configure Weblogic to receive TLS connections.