I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server).
I could understand that in case of HTTPS request, SSL handshake will happen, a tunnel will be created and then all the data for session would be encrypted.
But I couldn't get clear answer for below question:
- I am 90% sure that load balancer will not participate (or anything to do with) in SSL handshake because it is just for load balancing, so will forward to Apache based on its balancing algo. Could you please confirm?
- All the application resources are in Weblogic (application server), so I makes me feel that finally the encryption and SSL handshake (or tunnel) will happen from Weblogic, and it would be Weblogic which will select one of the cipher suites provides by web browser, for encryption.
- Am I correct?
- If yes then what would be the role of Apache in SSL handshake? Will Apache simply forward the request to Weblogic and the end-to-end tunnel will be between web browser and Weblogic?
- I read that maximum number of connections are controlled by Apache, so it suggests me that there would be a SSL handshake and tunnel between web browser and Apache. And if that happens then wouldn't it be overkill because there would be 2 SSL handshakes and encryption (web browser - Apache and Apache - Weblogic)?
- Whether Weblogic or Apache will do the cipher suite selection?
- I could identify that for Weblogic cipher suite selection can be controlled using
Dweblogic.security.SSL.Ciphersuites=TLS_RSA_WITH_AES_256_CBC_SHA256"
but how it can be controlled in Apache?
- I could identify that for Weblogic cipher suite selection can be controlled using