3 ms·
Clever. I think I'd prefer to do TLS termination at the proxy though, something akin to stunnel. Of course snid could be used together with stunnel, but I think
by zokier 5y ago
Clever. I think I'd prefer to do TLS termination at the proxy though, something akin to stunnel. Of course snid could be used together with stunnel, but I think it would lose the O(1) configuration then. Just terminating tls and not touching the http content would still avoid any of those http parsing issues mentioned.
- agwa 5y agoAn earlier version did the TLS termination in the proxy. It's true you can avoid the HTTP parsing issues, but you lose the ability to do client certs or have backend-specific cipher/TLS version requirements. Also, I really like it that IPv6 clients can connect directly to the backend, bypassing any proxies.