Forum Discussion
NimbostratusHTTP or HTTPs on backend servers if SSL Offloading is used
Hi All,
Please consider below line diagram as per my setup.
Client ===HTTPS===LTM===HTTP===Web SERVERs or DB servers
The server team can enable either HTTP or HTTPs on the backend servers for request incoming for accessing the content. Ideally, can you advise HTTP or HTTPs is recommended to enable on the web server to listen to for achieving this as connectivity between LTM and Server will be HTTP connection, however , the actual URL accessed by the client is HTTPs
Regards,
Dayesh
Ryan_80361Cirrostratus
If you intend to configure SSL offload on the LTM then you should configure the pool members to use HTTP, not HTTPS.
Dayesh_263997Hi Ryan,
Thanks for the response.
Does that mean the TOMCAT web server will enable HTTP service and not HTTPs at their end?
Regards,
Dayesh
RyannnnnnnnnAltocumulus
If you intend to configure SSL offload on the LTM then you should configure the pool members to use HTTP, not HTTPS.
- Dayesh_263997
Hi Ryan,
Thanks for the response.
Does that mean the TOMCAT web server will enable HTTP service and not HTTPs at their end?
Regards,
Dayesh
- Kevin_Stewart
Employee
I would probably argue that, with respect to increased security concerns and the "zero trust" movement, that a better practice would be to re-encrypt to the servers. You of course don't get the full performance benefit of SSL offload, but there's nothing that says you can't use 1K RSA keys on the inside to the servers, and 2K keys and/or ECC to the clients.
If you did re-encrypt to the Tomcat servers, it literally doesn't matter what certificates you apply to the servers, as the F5 will by default ignore server side certificate validation.
- Kevin_Stewart
SSL bridging means that you terminate client side TLS on the BIG-IP, and then re-encrypt to the server. This requires client and server SSL profiles. The client SSL profile should of course have your client-facing server certificate and private key, and have proper cipher support. The server side, because the internal TLS connection isn't validated by default, can be very simple. In fact you can usually get away with using the built-in "serverssl" profile on the LTM VIP.
So then, yes, the Tomcat server is listening on HTTPS, the BIG-IP VIP is listening on HTTPS, but traffic is decrypted on the BIG-IP.
