3 ms·
Wouldn't it be more common to have SSL termination done on a load balancer that forwards the traffic on to a group of instances?
by secondcoming 6y ago
Wouldn't it be more common to have SSL termination done on a load balancer that forwards the traffic on to a group of instances?
- Matthias247 6y agoIt depends on your overall system setup, and how much you trust the path between your LB and the actual webservers. You might even have TLS on both paths. Maybe using different certificates
- chmod775 6y agoDepends on where your main workload is. On my servers haproxy (doing SSL termination) accounts for about 70% of CPU time spent. Doing SSL termination on my load balancers would mean I would need about 2 "load balancers" for every 1 server - which could be a legitimate setup in other circumstances though. If I needed to do load balancing via an intermediate server, it would make more sense for me to load-balance on the raw (i.e. TLS traffic) TCP layer.