What Is SSL Passthrough? How Does It Work?

Unlike SSL Offloading, where the load balancer handles TLS decryption, SSL Passthrough keeps the traffic encrypted until it reaches the backend server. The server then decrypts the traffic using its own SSL/TLS certificate and private key.

SSL Passthrough allows a load balancer to forward encrypted traffic to backend servers without terminating the TLS connection.

The load balancer operates at the network or transport layer, typically using TCP on port 443. It distributes incoming connections but cannot inspect the encrypted HTTP requests or their contents.

The SSL/TLS certificate and corresponding private key must be installed on the backend server, where the TLS connection is terminated.

How Does SSL Passthrough Work?

The process follows these steps:

1. A client establishes an HTTPS connection and sends encrypted traffic to the load balancer.
2. The load balancer receives the connection and forwards the encrypted TCP traffic to a backend server.
3. The backend server completes the TLS handshake and decrypts the traffic using its certificate and private key.
4. The server processes the request and sends the response back through the load balancer to the client.

Throughout this process, the load balancer does not decrypt the HTTPS traffic.

Benefits of SSL Passthrough

• End-to-end TLS encryption: Traffic remains encrypted between the client and backend server, without TLS termination at the load balancer.
• Backend control: Backend servers handle their own certificates, private keys, and TLS configuration.
• Client certificate authentication: The backend can handle mutual TLS (mTLS) authentication directly.
• Simpler TLS processing at the load balancer: The load balancer forwards TCP connections without performing TLS decryption.

Drawbacks of SSL Passthrough

• Limited Layer 7 functionality: The load balancer cannot inspect HTTP headers, URLs, or request contents.
• No HTTP-based routing: Routing decisions based on URL paths or HTTP headers are generally unavailable.
• Higher backend workload: Backend servers handle TLS handshakes, encryption, and decryption.
• Certificate management: SSL/TLS certificates and private keys must be managed on the backend servers.
• Limited HTTP-level persistence: Cookie-based session persistence is unavailable because the load balancer cannot inspect HTTP cookies. Other persistence methods, such as source-IP affinity, may still be supported.

How to Configure SSL Passthrough

The exact configuration depends on the load balancer, but the general process is similar:

1. Configure a TCP listener: Set up the load balancer to accept TCP traffic on port 443 instead of terminating TLS with an HTTPS or TLS listener.
2. Configure the backend servers: Install a valid SSL/TLS certificate and its matching private key on each server.
3. Create a backend pool: Add the backend servers and configure the appropriate TCP port.
4. Configure health checks: Use TCP or another supported health-check method to monitor backend availability.
5. Test the connection: Access the website over HTTPS and verify that the TLS connection is established with the backend server.

With SSL Passthrough, the load balancer does not need the website's SSL/TLS certificate or private key.

What Is SSL Offloading?

SSL Offloading (also called TLS Termination) moves TLS encryption and decryption from backend servers to the load balancer.

The load balancer terminates the client's TLS connection, decrypts incoming traffic, and forwards requests to backend servers. This backend connection may use HTTP or a separate HTTPS connection, depending on the configuration.

Offloading reduces the TLS processing workload on backend servers and allows the load balancer to inspect HTTP traffic and apply Layer 7 features.

However, if the load balancer forwards requests over HTTP, the traffic between it and the backend servers is unencrypted. For sensitive applications, HTTPS or TLS Bridging can be used to protect this internal connection.

SSL Passthrough vs. SSL Offloading

Conclusion

SSL Passthrough and SSL Offloading handle HTTPS traffic differently. Passthrough keeps traffic encrypted until it reaches the backend server, while offloading moves TLS processing to the load balancer.

SSL Passthrough is useful when backend servers need to handle TLS connections directly, including client certificate authentication. SSL Offloading is more suitable when you need HTTP inspection, Layer 7 routing, or centralized certificate management.

The right approach depends on your security requirements, application architecture, and load-balancing capabilities.