In this article, we\u2019ll explore how\na regular SSL\/TLS connection works and how SSL offloading can help to improve site\nperformance. We\u2019ll also explore the types of SSL offloading, and their\nadvantages and disadvantages, so that you can decide whether it\u2019s the right\ntechnology for your website. <\/p>\n\n\n\n
What is SSL Offloading?<\/h2>\n\n\n\n
An SSL offloading relieves the\nburden of encryption and decryption from the server’s metaphoric shoulders. Here,\na separate SSL proxy device is placed between the browser (client) and the\nserver. This SSL offloading device is known as the application-specific integrated\ncircuit (ASIC) processer, a proxy server or a load balancer. They\u2019re designed\nto use the secure SSL\/TLS protocol to perform SSL termination and\/or SSL\nbridging to reduce the operational burden from the servers. <\/p>\n\n\n\n
The load balancer receives the\nencrypted traffic from the client. It decrypts the data and passes on the\nunencrypted data to the server. Sometimes, the device inspects the incoming HTTPS\ntraffic, filters malware (if any), and re-encrypts the data before sending it\nto the server. <\/p>\n\n\n\n
This load balancer can be a\nfirewall, a special application, or even a hardware device. Some of the popular\nSSL load balancer providers include: <\/p>\n\n\n\n
- F5<\/a>, <\/li>
- HAProxy<\/a>, <\/li>
- Cloudflare<\/a>, <\/li>
- Nginx<\/a>, <\/li>
- Kemp<\/a>, <\/li>
- loadbalancer.org<\/a>, and <\/li>
- Manage Engine.<\/a><\/li><\/ul>\n\n\n\n
How a Regular SSL Connection Is Made Without SSL Offloading <\/h2>\n\n\n\n
Now that you\u2019ve got a basic idea about the SSL offloading process, you might be wondering why it\u2019s needed in the first place. To understand that, you must be aware of how an SSL certificate works<\/a>. So, let\u2019s start with the basics: <\/p>\n\n\n\n
- When someone opens a website on their web browser, the browser tries to establish the HTTPS connection by performing the SSL\/TLS handshake<\/a>. It creates a session key<\/strong> that\u2018s then encrypted by using the public key<\/strong> of the website. <\/li>
- This encrypted session key reaches to the website\u2019s server. The server then decrypts it by using the website\u2019s private key<\/strong>.<\/li>
- Each website has its own unique set of public and private keys. These pairs are mathematically related to each other in a way that the data encrypted using a public key can be decrypted only by its corresponding private key. <\/li>
- Now, this session key is used for encrypting and decrypting data<\/strong> transmitted between browser and server for that entire session.<\/li><\/ul>\n\n\n\n
The Need for SSL Offloading<\/h2>\n\n\n\n
The public key and private key can\nbe 2048-bit long with RSA algorithm. It provides robust protection, but it\u2019s\nvery bulky and is relatively slow for encryption and decryption. <\/p>\n\n\n\n
The session key would support up to 256-bit encryption<\/a> strength. It\u2019s faster than 2048-bit keys, but when more people are trying to access a website at the same time, the server has to deal with numerous session keys and encryption\/decryption requests simultaneously. <\/p>\n\n\n\n
This task is processor-driven and\nutilizes the server\u2019s resources up to a great extent. Thus, the server gets\nexhausted and becomes slower. To reduce the encryption\/decryption burden from\nthe servers, the concept of SSL offloading was introduced in the industry. <\/p>\n\n\n\n
Note: The new <\/em>elliptic curve cryptography<\/em><\/a> (ECC) key has been introduced in the market to replace the 2048-bits RSA key. It provides the same level of protection with a smaller key size. However, only a handful of SSL certificates and platforms support it at this time. <\/em><\/p>\n\n\n\n
How Does SSL Offloading Work?<\/h2>\n\n\n\n
As we mentioned earlier, SSL\noffloading is deployed by placing a separate device \u2014 aka a load balancer \u2014 between\nthe browser and the server to handle the encryption and decryption tasks. The\nload balancer doesn\u2019t require a new SSL certificate. It utilizes the server\u2019s\nexisting SSL certificate and uses its private key to perform the job. <\/p>\n\n\n\n
There are two types of SSL\noffloading: SSL termination and SSL bridging. Let’s explore both of these types\nand their advantages and disadvantages. <\/p>\n\n\n\n
SSL Termination<\/h3>\n\n\n\n
As a type of SSL offloading, SSL\ntermination, essentially, is a process that helps to speed up the decryption\nprocess. It does this by connecting the client to the load balancer via the\nsecure, encrypted HTTPS connection, and then connecting them from the load\nbalancer to the web server via the insecure HTTP protocol. <\/p>\n\n\n\n
The connection between a client and\nthe load balancer will be encrypted. However, both the incoming and outgoing\ndata transmission between the load balancer and the server will remain\nunencrypted.<\/p>\n\n\n\n
It works like this:<\/p>\n\n\n\n
- A load balancer is connected to the browser and\nthe server. <\/li>
- When the browser tries to establish an SSL\/TLS\nconnection, the session key is generated between the browser and load balancer\nusing the website’s public and private keys. <\/li>
- All the data, which is encrypted by the browser,\nreaches to the load balancer device first. <\/li>
- The load balancer decrypts the data using the symmetric\nsession key and sends the unencrypted data to the server. <\/li>
- Hence, the server gets the data in plaintext and\ndoesn\u2019t need to decrypt it. <\/li>
- The server sends back the response in plaintext\nto the load balancer. <\/li>
- The load balancer encrypts the unencrypted data\nusing the session key and sends it to the client.<\/li>
- The client decrypts the data using the same\nsession key. <\/li><\/ul>\n\n\n\n
![\"The](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2020\/03\/load-balancer-new.png\")
<\/figure><\/div>\n\n\n\nPros of SSL Termination:<\/h4>\n\n\n\n
- The server doesn\u2019t need to encrypt and decrypt all\nof the incoming and outgoing data. That\u2019s what reduces the workload and saves\non computational overhead. <\/li>
- It helps enterprises improve their server speed.\n<\/li>
- SSL termination is a highly effective method for\nwebsites that don’t deal with users’ sensitive information. For example, blogs,\ninformative sites (such as Wikipedia), media sharing websites (such as YouTube,\nPexels, etc.). <\/li><\/ul>\n\n\n\n
Cons of SSL Termination:<\/h4>\n\n\n\n
- The traffic between the load-balancer and the server is unencrypted and, therefore, is vulnerable to data theft, session hijacking, and man-in-the-middle (MitM) attacks. In a way, the purpose of the SSL certificate is destroyed because the encryption is lost mid-process. <\/li>
- The server must share the private key with the load balancer tool. It\u2019s a risky practice. <\/li>
- Clients won\u2019t get any alerts if the HTTPS session is compromised between a load balancer and the server. So, in a way, it deceives web users into believing that their data is more secure than it may actually be.<\/li>
- An element of secrecy and privacy could be lost when all of your data is exposed to a third-party load balancer platform.<\/li><\/ul>\n\n\n\n
SSL Bridging <\/h3>\n\n\n\n
Websites that handle users\u2019\nsensitive information such as personal information, payment card numbers,\nhealth data, military information, tax related data, etc. aren’t appropriate\nfor deploying SSL termination. Sometimes, these types of websites are capable of\nhandling a large quantity of the HTTPS traffic. But they get slower when they\nhave to constantly deal with the malware and corrupted data coming from the\nclient. In such cases, SSL bridging, another SSL offloading method, proves more\nefficient than SSL termination.<\/p>\n\n\n\n
Much like with SSL termination, SSL\nbridging also places a load balancer between a client and the server. <\/p>\n\n\n\n
When a client sends the encrypted\ndata via HTTPS to the load balancer, it decrypts the data. Then, it performs\nthe SSL inspection task. The load balancer performs deep-packet inspection for\nall the HTTPS traffic, and if it finds anything suspicious, it blocks such\ncontent. It\u2019s like a man-in-the-middle attack, but it\u2019s done with the goal of\nprotecting users rather than exploiting them!<\/p>\n\n\n\n
After that, instead of sending the\nplaintext data to the server, the load balancer re-writes and re-encrypts the\ninformation and forwards it to the server. Thus, the data remains encrypted throughout\nthe entire route and remain secure. As you have guessed correctly, the server still\nneeds to go through the encryption and decryption process. <\/p>\n\n\n\n
In SSL bridging, the SSL load\nbalancer filters out viruses, spyware, and other sorts of malware coming from\nthe client. <\/p>\n\n\n\n
Pros of SSL Bridging<\/h4>\n\n\n\n
- Data security isn\u2019t compromised because the data remains encrypted during the entire transmission process i.e., from the client to the load balancer, and from the load balancer to the server. <\/li>
- It saves the server from the most common web-application attacks<\/a> such as SQL injections, distributed denial of service (DDoS) attacks, and cross-site request forgeries. <\/li><\/ul>\n\n\n\n
Cons of SSL Bridging<\/h4>\n\n\n\n
- This encrypted session key reaches to the website\u2019s server. The server then decrypts it by using the website\u2019s private key<\/strong>.<\/li>
- HAProxy<\/a>, <\/li>