A fairly basic SSL question, if you don't mind:

Lets say I have traffic flow from a client to a web server as follows:

[client] --> [public SLB:80] --> [reverse proxy:80] --> [internal SLB:80] --> [webserver:443]

Will parts of the traffic as it traverse this topology be unencrypted or will the SSL handshake succeed when a request finally lands at the web server?

I am trying to determine if I need SSL certs installed on each device in the chain.

  • Unfortunately, questions about protocols above OSI layer-4 are explicitly off-topic here. You should try to ask this question on Server Fault for a business network, or on Super User for a home network. – Ron Maupin Jun 1 '16 at 15:59

It all depends on your SLB and proxy configuration, each of these elements can decrypt SSL or not.

None of these intermediate elements requires SSL decryption/termination for it's basic operations. All of these elements could do it for deep packet inspection, either for security or optimized load balancing reasons.

Assuming :80 port on the end of the node signifies these are all HTTP LBs/proxies and assuming these elements allow for HTTP Connect tunneling, the client will ask an HTTP Proxy to forward the TCP connection to the desired destination. Client will than establish direct SSL session with the webserver through that TCP "tunnel", so you need no SSL certificates on intermediate nodes.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.