1

Trying to understand some fundamentals.

If I want a load balancer for the benefits of caching and more intelligent load balancing, I see that I should probably consider L7 despite some of the performance hit I'll take no sticking with standard TCP/IP communication.

Now, let's say I have TLS termination at the LB level, however, I still want TLS communication from the LB communication to the micro-service or downstream server I'm communicating with.

Is the flow like so:

  1. Client makes request to https://example.com
  2. TLS handshake begins by sending serverHello to load balancer, which then proxies the serverHello to the backend application.
  3. Without writing all the steps, I'm assuming the entire TLS handshake takes place with the LB as an intermediary, but with this idea that the LB itself is doing this kinda of separate TLS handshaking process and encryption + decryption with the downstream server.

Is that a correct line of thinking and is this how it works in the real world?

I personally am conceptualizing this as something you'd want because the communication from the LB to the service could cross boundaries of separate servers over a network, so you'd have a second TLS connection to avoid packet sniffing after the second connection is made.

2

If you're doing layer 7 (regardless of TLS termination) then the incoming connection terminates at the load balancer. The LB opens a completely new connection to your backend server, the lifetime of which is entirely independent from any client connections. The LB will then pass requests over that connection to your backend, if it doesn't handle them itself (e.g. by sending a cached response).

P.S. Your direction is reversed: downstream is toward the user agent, and upstream is toward your backend server.

3
  • but if I want TLS for the second connection, does the handshake process happen between LB and backend? – John Feb 24 at 16:07
  • @John Yes, there is a completely new connection made between the load balancer and backend in this configuration. Please let me know specifically what is not clear about this and I will try to clarify it. – Michael Hampton Feb 24 at 19:28
  • Thanks for the response – John Feb 24 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.