Forum Discussion

LanceLyons's avatar
LanceLyons
Icon for Cirrus rankCirrus
Nov 28, 2022

SSL Full Proxy - SSL Re-Encryption performance degradation

Hi,  We have traditionally been a shop that used SSL encryption to the F5 and decrypted text to webservers  (https to F5 and http to webservers).   We are being asked to encrypt the full route.  We a...
application delivery
devops
security
Mohamed_Ahmed_Kansoh's avatar
Mohamed_Ahmed_Kansoh
Icon for MVP rankMVP
Nov 28, 2022

Hi LanceLyons , 
No issues from F5 perspective as ( irules , loadbalancing and persistence shouldn’t be impacted ) because F5 interested in decrypting traffic that coming from client-side to deal with http payload decrypted. 

> when you configure server ssl or ssl bridging  you re-encrypt traffic again and directs it web servers encrypted , F5 hasn’t issues in this scenario , you need only to check the server itself , if it affords the process of decryption again as you know in " ssl offloading " you let F5 to be the only hop which performs decryption and offloads servers to do this exhausting task.

> usually I performs " SSL bridging (configure client and server ssl profiles )" with our customers , and we have not faced any issues regarding server ssl to re-encrypt traffic again. 

Regards 

  • LanceLyons's avatar
    LanceLyons
    Icon for Cirrus rankCirrus
    Nov 28, 2022

    Thanks Mohamed,   

    Have you all noticed any performance degradation to heavily used websites from an end user perspective with the decryption at f5 and reencrypt at f5?

    • Mohamed_Ahmed_Kansoh's avatar
      Mohamed_Ahmed_Kansoh
      Icon for MVP rankMVP
      Nov 28, 2022

      LanceLyons , 
      No , I performs ssl bridging for high traffic virtual servers , these virtual servers serves public services over internet for ISPs and there is no issues regarding it server-ssl or re-encrypting traffic towards web-servers. 

      > I always offer them not to do this to lighweight the headache on webservers. 

      > to be sure , cofigure it and monitor your CPU periodically. 

      Regards