Our sys admin has set up a load-balancer that handles all HTTPS requests and proxies them to the server as HTTP. The server doesn't have HTTPS so the connection between LB and server is un-secure but the connection to the LB is. I'd never seen something like that and I am not really sure it's the proper way to do it. The actual server is not available publicly, only through the load-balancer.

  • Is this enough to make it secure? Could one bypass the load-balancer?

  • Is this a standard technique?

  • Yes and no, it depends on the network setup. Also, the word redirect is a bit misleading here, since that implicates HTTP redirection with 301 and 302 error codes. It looks like you mean proxying. – Tero Kilkanen Aug 11 '16 at 9:01
  • @TeroKilkanen yes, the load-balancer is proxying HTTPS to HTTP. – algiogia Aug 11 '16 at 9:21

This is typically called 'SSL offloading' and is quite common in bigger setups. It reduces load on the back end servers, since many hardware loadbalancers have special crypto chips which can handle a lot of SSL traffic at high speed. Another benefit is that you have to store the SSL certificate and its private key only in one place, and will only need to replace it there when the certificate it's close to expiring.

One requirement to make it secure is that the nodes which are being loadbalanced aren't reachable any other way. Typically, these nodes are only connected on private IP addresses which aren't routed even within the network, so there's only a layer 2 (ethernet) network between the servers and load balancer, and no other way to connect to servers.

In some cases (for example hosting of PCI compliant setups) this won't be enough, so often SSL re-encryption is used there. In that case the connection between the load balancer and the servers is via SSL as well. The loadbalancer decrypts traffic coming from clients, does its magic (for example pick the right node to proxy traffic to, do some rewriting tricks, etc) and then encrypts it again on the connection to the backend server.

  • Thanks Teun. Can you point me to any source? – algiogia Aug 12 '16 at 10:03
  • A source for what exactly? – Teun Vink Aug 12 '16 at 10:54
  • SSL offloading: what it is, how should be configured... – algiogia Aug 12 '16 at 11:19
  • That depends on your setup, the load balancers you have and your requirements. – Teun Vink Aug 12 '16 at 11:32

If the network between load balancer and internal servers is secure from eavesdropping, then it makes no difference if http or https is used between them.

  • Do you have any resources? – algiogia Aug 11 '16 at 9:38
  • No difference? What if the load balancer is also doing routing based on the request or session? What about the costs of SSL session negotiation vs resumption? What about the impact of latency when the balancer is closer to the client than the server? – symcbean Aug 11 '16 at 11:16
  • Good points. I was only answering on the original question with respect to security. I also assumed that the load balancer sees the unencrypted traffic so that it can do routing and after that use https to the upstream server. But you are right, my answer could have been better. Teun's answer above is really good. – Tero Kilkanen Aug 11 '16 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.