Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently our firewalls inspect packets looking for certain known attack vectors. If my application goes pure ssl we'll lose that ability correct?

Granted we've lost that ability on our current ssl'd pages.

share|improve this question

"It depends." You can set your firewall up so that the SSL termination happens on the firewall, thus the data stream can be inspected there, and then passed on to the back-end server via a different SSL certificate or non-SSLed. Generally (meaning in my experience) this is only done for larger-scale installations with dedicated hardware firewalls like a Cisco PIX or an accelerator like an F5, but it is possible even for a Linux iptables-based firewall utilizing Squid as an inbound proxy.

share|improve this answer

Usually you put an SSL accelerator in front of the IPS/IDS Firewalling, then the application servers. This not only allows for your to continue inspecting/filtering, but also offloads the relatively heavy connection process of SSL from your application servers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.