SSL Offloading 101: Definition, Processes & Objectives | Okta (2024)

FAQs

SSL Offloading 101: Definition, Processes & Objectives | Okta? ›

Two main types of SSL offloading exist: SSL termination: Your SSL load balancer sits on the edge, and it grabs all incoming traffic. After decryption, the balancer passes on the traffic via non-encrypted means. SSL bridging: Your SSL load balancer sits on the edge and grabs all incoming traffic.

SSL offloading is the process of removing the SSL-based encryption from incoming traffic to relieve a web server of the processing burden of decrypting and/or encrypting traffic sent via SSL.

When a client initiates an SSL connection, the load balancer intercepts the SSL handshake process and negotiates the encryption parameters with the client, just like in SSL Passthrough. However, in SSL Offloading, the load balancer acts as the SSL endpoint, terminating the SSL connection and decrypting the SSL traffic.

Benefits of SSL Offloading

This results in smooth loading of the website and faster processing of requests at the end of the web application. It may also aid in HTTPS inspection, reverse proxy, traffic control, persistence of cookies, etc., depending on what kind of SSL load balancer you have installed at your end.

SSL bridging: The Load Balancer decrypts incoming HTTPS traffic, and re-encrypts it when sending to the backend server. SSL offloading (aka SSL termination): The Load Balancer decrypts incoming HTTPS traffic, and sends it to the backend server unencrypted.

Offloading refers to the data transfer from a digital device to another digital device. It is a solution where computations are migrated to the resourceful computers in order to increase the capabilities of mobile devices. This method is different from the conventional client-server architecture.

SSL Bridging: The Load Balancer/Proxy decrypts incoming HTTPS traffic and re-encrypts it before forwarding it to the backend server. SSL Offloading (also known as SSL Termination): The Load Balancer/Proxy decrypts incoming HTTPS traffic and sends it to the backend server without encryption.

SSL encoding ensures user communications are secure. The encryption and decryption of SSL are CPU intensive and can put a strain on server resources. In order to balance the compute demands of SSL encryption and decryption of traffic sent via SSL connections, SSL offloading moves that processing to a dedicated server.

SSL Offloading

Terminates the connection on a device between the client and the Exchange Server and then uses a nonencrypted connection to connect to the Exchange Server.

SSL termination at load balancer alleviates web servers of the extra compute cycles needed to decrypt SSL traffic. The security risk of terminating at the load balancer is lessened when the load balancer is within the same data center as the web servers.

What are the risks of SSL offloading? ›

Disadvantages: If the SSL termination takes place in an internal network and the communication between the SSL offloading device and the web server is not sufficiently secure, there is a risk of interception or manipulation within the internal network.

SSL: Secure Sockets Layer

SSL is standard technology for securing an internet connection by encrypting data sent between a website and a browser (or between two servers). It prevents hackers from seeing or stealing any information transferred, including personal or financial data.

The client generates a random symmetric key and encrypts it using server's public key. The client and server now both know the symmetric key and can use the SSL encryption process to encrypt and decrypt the information contained in the client request and the server response.

Improved Server Performance: SSL/TLS offloading reduces the processing burden on servers by moving SSL/TLS encoding/decoding functions away from busy web servers to specialized devices. This allows the web servers to dedicate important CPU resources to other application processing tasks, which can improve performance.

SSL passthrough feature allows you to pass incoming security sockets layer (SSL) requests directly to a server for decryption rather than decrypting the request using a load balancer. SSL passthrough is widely used for web application security and it uses the TCP mode to pass encrypted data to servers.

In an SSL stripping attack, the attacker intercepts all traffic between the client and the server and “strips” any SSL content from the client's requests before passing them on to the server. As a result, the server will provide the unencrypted HTTP version of the page, which the attacker sends on to the client.

SSL termination or SSL offloading decrypts and verifies data on the load balancer instead of the application server. Spared of having to organize incoming connections, the server can prioritize on other tasks like loading web pages. This helps increase server speed.