What Is SSL Passthrough and How Does it Work?

Configuring SSL for web servers can be complex, with various methods available depending on your server setup. One such option is SSL/TLS Passthrough, which bypasses the need for decryption and re-encryption of data at the intermediary server, maintaining end-to-end encryption.

In this article, we’ll explore SSL Passthrough, its benefits, drawbacks, and how it differs from other SSL configurations, providing a clear understanding of its role in securing web connections.

---

Table of Contents

1. What Is SSL Passthrough?
2. How Does SSL Passthrough Work?
3. SSL Passthrough Advantages
4. SSL Passthrough Disadvantages
5. How to Configure SSL Passthrough?
6. SSL Passthrough vs SSL Offloading
7. SSL Passthrough vs SSL Termination
8. SSL Bridging vs SSL Passthrough

---

What Is SSL Passthrough?

SSL Passthrough is a networking configuration that keeps end-to-end security by forwarding encrypted traffic directly from the client to the backend server via a load balancer or proxy server. Unlike SSL termination, which involves decrypting traffic at the load balancer, SSL Passthrough preserves the confidentiality and integrity of sensitive data without decryption at the traffic distributor level.

Now, if you’re not familiar with load balancers, they’re devices or software that evenly distribute incoming network traffic across multiple backend servers within a public or private network to ensure efficient resource utilization and prevent overload on any single server.

---

How Does SSL Passthrough Work?

SSL passthrough involves the following steps:

1. Client Sends Request: A client (like a web browser) sends a request to access a website.
2. Proxy Server Receives Request: The request is intercepted by a proxy server or load balancer, which acts as an intermediary.
3. Identifying Secure Connection: The proxy server recognizes the need for a HTTPS (Hypertext Transfer Protocol Secure) connection indicated by SSL certificates.
4. Establishing SSL Connection: The proxy server initiates an SSL handshake with the client without decrypting the data.
5. Forwarding Request: The intermediary server forwards the client’s encrypted request to the web server.
6. Web Server Processes Request: The web server receives and processes the request, generating a response.
7. Response Sent to Proxy Server: The server sends the response back to the intermediary server.
8. Forwarding Response: The proxy server forwards the encrypted response to the client through the specified SSL connection.
9. Client Receives Response: The client receives and processes the encrypted response, completing the communication.

The proxy or load balancer handles the encrypted HTTP traffic between the client and the web server without decrypting the data. This approach ensures data confidentiality and integrity throughout the communication without additional decryption and inspection.

---

SSL Passthrough Advantages

SSL Passthrough benefits include enhanced data security, better website performance, and a seamless user experience. It also significantly reduces server load, promoting overall system efficiency.

• Enhanced Data Security: SSL Passthrough protects confidential data from hackers by creating a secure tunnel between your device and the server. It prevents anyone from reading your sensitive information.
• Faster Website Performance: SSL Passthrough helps your website load faster by taking the burden of encryption off the server. This means more people can visit your site at once without it slowing down.
• Reduced Server Load: SSL Passthrough lightens the load on your server by handling encryption elsewhere. As a result, your server can respond quickly to requests, even during busy times.
• Application Compatibility: SSL Passthrough allows for smooth integration with various applications and services without modifications or adjustments, ensuring compatibility and ease of use across different platforms.
• Cost Savings: By offloading SSL decryption to a load balancer, SSL Passthrough can save you money on server resources and maintenance costs, reducing the strain on your server and extending its lifespan.

---

SSL Passthrough Disadvantages

• Complex Configuration: Setting up SSL Passthrough requires technical expertise and involves complex configuration processes, including adjusting firewall rules and dealing with compatibility issues between SSL/TLS versions and cipher suites.
• Compromised Traffic: SSL Passthrough allows encrypted traffic to reach the backend server directly, which means compromised code within the encrypted traffic could potentially harm the server.
• Incompatibility with HTTP Profiles: SSL Passthrough doesn’t support HTTP profiles, which are configurations used to optimize HTTP traffic. This can lead to potential limitations in traffic management and optimization.
• Inability for Server Changeovers: The SSL Passthrough process doesn’t support quick changeovers between servers, impacting system reliability and failover capabilities.
• Limitations with Cookie Persistence: Cookie persistence, a method used to maintain sessions between clients and servers, cannot be utilized with SSL Passthrough, potentially impacting session management and user experience.

---

How to Configure SSL Passthrough?

To configure SSL Passthrough for a proxy server or load balancer, follow these steps:

1. Choose Your Load Balancer: Decide whether you’ll use a hardware-based solution like F5 or a software-based like HAProxy or Nginx.
2. Install Your Load Balancer: Install the chosen load balancer on your network.
3. Configure TCP and HTTP Modes: In your load balancer’s settings, configure both the TCP (Transmission Control Protocol) and the HTTP modes for the frontend and backend. This way, the load balancer handles the traffic appropriately.
4. Enable SSL Passthrough: Locate the ‘SSL/TLS’ section in your load balancer’s settings and enable the ‘SSL Passthrough’ option. It utilizes the TCP mode to securely deliver encrypted traffic to the backend servers.
5. Install SSL Certificates on Backend Servers: Although SSL certificate installation on the load balancer is not required for SSL Passthrough, ensure that SSL/TLS certificates are installed on the backend servers to secure the connections.
6. Specify Backend Servers: In the ‘Backend’ section of the load balancer’s configuration, enter the IP addresses of the backend servers where to direct the SSL-encrypted traffic.
7. Save and Apply Settings: Once you’ve configured SSL Passthrough, specified the backend servers, and ensured proper TCP and HTTP modes, save your settings and apply them to activate it.

---

SSL Passthrough vs SSL Offloading

SSL Passthrough allows secure traffic to pass untouched directly to the server. It functions by not decrypting the traffic and maintaining the original encryption from client to server.

SSL Offloading differs by decrypting the SSL traffic at the load balancer level. This method offloads the SSL traffic processing from the server, freeing up resources and improving server performance. It allows for traffic inspection and intrusion detection. However, it doesn’t provide end-to-end encryption.

Choosing between them depends on your specific needs. If end-to-end encryption is a high priority and you’re not as concerned about server load, SSL Passthrough might be your best bet.

---

SSL Passthrough vs SSL Termination

Ever wonder how SSL Passthrough compares to SSL Termination? Opt for the former if you prioritize processing speed over traffic inspection and manipulation.

With SSL Termination, the SSL connection ends or ‘terminates’ at the load balancer. The traffic is decrypted, inspected, and then sent to the server unencrypted or re-encrypted.

SSL termination is more CPU-intensive than the SSL Passthrough but gives the advantage of managing traffic and applying security features like DDoS protection and WAF (Web Application Firewall).

---

SSL Bridging vs SSL Passthrough

SSL bridging, SSL termination, and SSL offloading are terms often used interchangeably, but they can have slightly different meanings depending on the context.

SSL bridging decrypts SSL/TLS traffic at a proxy or load balancer before forwarding it to the backend server. After decrypting the traffic, the proxy can inspect or modify it if necessary before re-encrypting it and sending it to the backend server. SSL bridging allows for traffic visibility and control at the proxy level.

Once the traffic has been processed, the load balancer then re-encrypts it using its own SSL certificate before sending it to the backend servers.

Use SSL Bridging to detect and block malicious traffic, implement content-based routing to direct requests to specific backend servers based on their content or origin, or perform optimizations like caching or compression.

---

Bottom Line

In conclusion, SSL Passthrough maintains secure, encrypted connections while bypassing decryption processes. Despite minor downsides, its benefits, like preservation of end-to-end encryption and reduced load on servers, are significant.

Configuration may vary, but the process is generally straightforward. When compared to SSL Offloading, Termination, and Bridging, it’s clear each method has its unique applications. Your decision should prioritize the specific needs and security requirements of your network.