SSL/TLS termination - concepts

SSL/TLS termination can be handled in the following ways:

On the Real Servers (recommended) - aka SSL Passthrough
On the load balancer - aka SSL Offloading
On the load balancer with re-encryption to the Real Servers - aka SSL Bridging

Terminating SSL on the load balancer can be very CPU intensive. In most cases, for a scalable solution, terminating SSL on the Real Servers is the best option.

The following sections describe each method.

On the Real Servers (SSL Passthrough)

Here, the SSL certificate is installed on each Real Server. Data is encrypted from the client all the way through to the Real Server, providing full end-to-end encryption.

The load balancer is configured with a Layer 7 service that listens on port 443 and distributes inbound requests to the Real Servers on port 443, as shown below:

This is the recommended solution. It is the most scalable approach and avoids the CPU overhead of terminating SSL on the load balancer.
HTTP cookie persistence, header manipulation and other Layer 7 techniques that control how traffic is sent to the Real Servers cannot be used, because the data remains encrypted as it passes through the load balancer.

On the Load Balancer (SSL Termination / SSL Offloading)

Here, the SSL certificate is installed on the load balancer. Data is encrypted from the client to the load balancer, then passed to the Real Servers unencrypted.

The load balancer is configured with a Layer 7 service that listens on port 443, handles decryption and load balancing, and forwards the decrypted requests to the Real Servers on port 80, as shown below.

Certificates can be uploaded or created as explained in SSL Certificate.
Because the load balancer can see the unencrypted traffic, cookie based persistence, header manipulation and other Layer 7 techniques can be used to control traffic flow to the Real Servers.

On the Load Balancer with Re-encryption to the Real Servers (SSL Bridging)

Here, SSL certificates are installed on the load balancer and the Real Servers. Data is encrypted from the client to the load balancer and re-encrypted from the load balancer to the Real Servers. This provides end-to-end encryption while still allowing the load balancer to inspect/modify the traffic.

The load balancer is configured with a Layer 7 service that listens on port 443 and handles decryption, load balancing and re-encryption to the Real Servers on port 443, as shown below.

Certificates can be uploaded or created as explained in SSL Certificate.
Cookie based persistence, header manipulation and other Layer 7 techniques can be used to control traffic flow to the Real Servers.

Configuration

SSL Termination is configured within the Layer 7 Virtual Service. For more information, see Adding Layer 7 Virtual Services.