TLS Termination
TLS termination is the practice of decrypting TLS traffic at a load balancer or reverse proxy rather than at the application server. The proxy handles certificate management, cipher negotiation, and CPU-intensive cryptographic operations. Backend traffic between proxy and application runs over HTTP (or re-encrypted with a simpler internal cert).
Definition
TLS termination offloads encryption/decryption from application servers to a dedicated endpoint – typically a load balancer (AWS ALB, F5, HAProxy) or reverse proxy (Nginx, Caddy). The termination point holds the private key and certificate, negotiates TLS with clients, and forwards decrypted HTTP to backend servers. This simplifies certificate management (one cert per domain, managed at the proxy) and improves performance (dedicated hardware acceleration, connection reuse). The tradeoff is that traffic between the proxy and backend is unencrypted unless re-encrypted (TLS re-encryption or mTLS). In zero-trust architectures, re-encryption to backends is standard. The X-Forwarded-Proto header tells backends whether the original client connection was HTTPS, enabling correct redirect URLs.
Examples
- –Nginx: ssl_certificate /path/to/cert.pem; proxy_pass http://backend:8080;
- –AWS ALB terminates TLS and forwards to target group on port 80
- –Caddy auto-provisions Let's Encrypt certs and terminates TLS automatically
Related Protocols
Related Terms
Certificate Authority (CA)
A Certificate Authority issues and signs TLS certificates that browsers and operating systems trust. CAs verify domain ownership (DV), organization identity (OV), or extended validation (EV) before signing. The CA system relies on ~150 root certificates pre-installed in trust stores. Let's Encrypt automated DV issuance, issuing 400M+ active certificates.
SNI (Server Name Indication)
SNI is a TLS extension that sends the requested hostname in the ClientHello message, allowing one IP address to serve multiple TLS certificates. Without SNI, each HTTPS site needs its own IP. SNI is sent in cleartext – Encrypted Client Hello (ECH) encrypts it to prevent network observers from seeing which site is being accessed.
HSTS (HTTP Strict Transport Security)
HSTS is an HTTP response header that instructs browsers to only connect via HTTPS for a specified duration. Once set, the browser refuses HTTP connections to that domain – even if the user types http://. HSTS prevents SSL-stripping MITM attacks. The preload list hardcodes HSTS into browsers, protecting even the first visit.