March 12, 2020 0

What Is SSL Offloading? Features & Benefits of SSL Offloading

in Encryption

(16 votes, average: 4.50 out of 5)

Loading...

SSL offloading is a great solution for enterprises that wish to improve website performance without compromising security — here’s how it works

SSL offloading is a solution that some enterprises choose to use to reduce latency and demand on their servers.

As a website user, you might have noticed that certain websites get slower when there’s a large number of people accessing them at the same time. For example, entertainment websites (when a new episode of a popular series goes on air), news channel websites (at the time of elections), sports websites (during major events and competitions), etc.

But do you know that the same thing can happen to your website if it gets more traffic than usual? One of the reasons for such latency is an SSL/TLS certificate you have installed on the server. You can’t (and must not) remove it due to security reasons, but you can improve the speed of the server by integrating SSL offloading into your processes.

In this article, we’ll explore how a regular SSL/TLS connection works and how SSL offloading can help to improve site performance. We’ll also explore the types of SSL offloading, and their advantages and disadvantages, so that you can decide whether it’s the right technology for your website.

What is SSL Offloading?

An SSL offloading relieves the burden of encryption and decryption from the server’s metaphoric shoulders. Here, a separate SSL proxy device is placed between the browser (client) and the server. This SSL offloading device is known as the application-specific integrated circuit (ASIC) processer, a proxy server or a load balancer. They’re designed to use the secure SSL/TLS protocol to perform SSL termination and/or SSL bridging to reduce the operational burden from the servers. 

The load balancer receives the encrypted traffic from the client. It decrypts the data and passes on the unencrypted data to the server. Sometimes, the device inspects the incoming HTTPS traffic, filters malware (if any), and re-encrypts the data before sending it to the server.

This load balancer can be a firewall, a special application, or even a hardware device. Some of the popular SSL load balancer providers include:

• F5,
• HAProxy,
• Cloudflare,
• Nginx, 
• Kemp,
• loadbalancer.org, and
• Manage Engine.

How a Regular SSL Connection Is Made Without SSL Offloading

Now that you’ve got a basic idea about the SSL offloading process, you might be wondering why it’s needed in the first place. To understand that, you must be aware of how an SSL certificate works. So, let’s start with the basics:

• When someone opens a website on their web browser, the browser tries to establish the HTTPS connection by performing the SSL/TLS handshake. It creates a session key that‘s then encrypted by using the public key of the website.
• This encrypted session key reaches to the website’s server. The server then decrypts it by using the website’s private key.
• Each website has its own unique set of public and private keys. These pairs are mathematically related to each other in a way that the data encrypted using a public key can be decrypted only by its corresponding private key.
• Now, this session key is used for encrypting and decrypting data transmitted between browser and server for that entire session.

The Need for SSL Offloading

The public key and private key can be 2048-bit long with RSA algorithm. It provides robust protection, but it’s very bulky and is relatively slow for encryption and decryption.

The session key would support up to 256-bit encryption strength. It’s faster than 2048-bit keys, but when more people are trying to access a website at the same time, the server has to deal with numerous session keys and encryption/decryption requests simultaneously.

This task is processor-driven and utilizes the server’s resources up to a great extent. Thus, the server gets exhausted and becomes slower. To reduce the encryption/decryption burden from the servers, the concept of SSL offloading was introduced in the industry.  

Note: The new elliptic curve cryptography (ECC) key has been introduced in the market to replace the 2048-bits RSA key. It provides the same level of protection with a smaller key size. However, only a handful of SSL certificates and platforms support it at this time.

How Does SSL Offloading Work?

As we mentioned earlier, SSL offloading is deployed by placing a separate device — aka a load balancer — between the browser and the server to handle the encryption and decryption tasks. The load balancer doesn’t require a new SSL certificate. It utilizes the server’s existing SSL certificate and uses its private key to perform the job.

There are two types of SSL offloading: SSL termination and SSL bridging. Let’s explore both of these types and their advantages and disadvantages.

SSL Termination

As a type of SSL offloading, SSL termination, essentially, is a process that helps to speed up the decryption process. It does this by connecting the client to the load balancer via the secure, encrypted HTTPS connection, and then connecting them from the load balancer to the web server via the insecure HTTP protocol.

The connection between a client and the load balancer will be encrypted. However, both the incoming and outgoing data transmission between the load balancer and the server will remain unencrypted.

It works like this:

• A load balancer is connected to the browser and the server.
• When the browser tries to establish an SSL/TLS connection, the session key is generated between the browser and load balancer using the website’s public and private keys.
• All the data, which is encrypted by the browser, reaches to the load balancer device first.
• The load balancer decrypts the data using the symmetric session key and sends the unencrypted data to the server.
• Hence, the server gets the data in plaintext and doesn’t need to decrypt it.
• The server sends back the response in plaintext to the load balancer.
• The load balancer encrypts the unencrypted data using the session key and sends it to the client.
• The client decrypts the data using the same session key.

Pros of SSL Termination:

• The server doesn’t need to encrypt and decrypt all of the incoming and outgoing data. That’s what reduces the workload and saves on computational overhead.
• It helps enterprises improve their server speed.
• SSL termination is a highly effective method for websites that don’t deal with users’ sensitive information. For example, blogs, informative sites (such as Wikipedia), media sharing websites (such as YouTube, Pexels, etc.).

Cons of SSL Termination:

• The traffic between the load-balancer and the server is unencrypted and, therefore, is vulnerable to data theft, session hijacking, and man-in-the-middle (MitM) attacks. In a way, the purpose of the SSL certificate is destroyed because the encryption is lost mid-process.
• The server must share the private key with the load balancer tool. It’s a risky practice.
• Clients won’t get any alerts if the HTTPS session is compromised between a load balancer and the server. So, in a way, it deceives web users into believing that their data is more secure than it may actually be.
• An element of secrecy and privacy could be lost when all of your data is exposed to a third-party load balancer platform.

SSL Bridging

Websites that handle users’ sensitive information such as personal information, payment card numbers, health data, military information, tax related data, etc. aren’t appropriate for deploying SSL termination. Sometimes, these types of websites are capable of handling a large quantity of the HTTPS traffic. But they get slower when they have to constantly deal with the malware and corrupted data coming from the client. In such cases, SSL bridging, another SSL offloading method, proves more efficient than SSL termination.

Much like with SSL termination, SSL bridging also places a load balancer between a client and the server.

When a client sends the encrypted data via HTTPS to the load balancer, it decrypts the data. Then, it performs the SSL inspection task. The load balancer performs deep-packet inspection for all the HTTPS traffic, and if it finds anything suspicious, it blocks such content. It’s like a man-in-the-middle attack, but it’s done with the goal of protecting users rather than exploiting them!

After that, instead of sending the plaintext data to the server, the load balancer re-writes and re-encrypts the information and forwards it to the server. Thus, the data remains encrypted throughout the entire route and remain secure. As you have guessed correctly, the server still needs to go through the encryption and decryption process.

In SSL bridging, the SSL load balancer filters out viruses, spyware, and other sorts of malware coming from the client.

Pros of SSL Bridging

• Data security isn’t compromised because the data remains encrypted during the entire transmission process i.e., from the client to the load balancer, and from the load balancer to the server.
• It saves the server from the most common web-application attacks such as SQL injections, distributed denial of service (DDoS) attacks, and cross-site request forgeries. 

Cons of SSL Bridging

• The biggest disadvantage of the SSL bridging is the re-writing process. The load balancer will be given authority to inspect and modify the client data if its artificial intelligence (AI) finds anything suspicious. It re-encrypts and send along only that content that it deems safe. Thus, you will rely on the AI of load balancer for your all incoming data. If the load balancer’s AI is suffering from a false positive (i.e. considering safe traffic to be malicious by mistake) and blocking it, you’ll miss the important (and safe) traffic, too.  
• The load for encryption and decryption doesn’t get reduced from the server.

A Final Word

There is no place for a slower website in this highly competitive world. If your website delays the loading of content by even a couple of seconds, people move on to another site — possibly, one of your competitors’ sites. At the same time, if you uninstall an SSL certificate from your website, it leaves the site and any sensitive information it collects vulnerable to cyber attacks.

Considering the risks and circumstances, with the SSL offloading technology, you get the best of both worlds. You get an improved speed without compromising the security. However, SSL offloading technology also suffers from flaws and poses a security risk to the website. After reading the advantages and disadvantages of both the SSL offloading types, you must choose which method is most suitable for your server because the same load balancer won’t perform SSL termination and SSL bridging simultaneously.

In any case, choose the load balancer provider very carefully because virtually all of them require you to hand over your private key.

• #SSL offloading