3 ms·

> Why would you expect TLS to work correctly on a HTTP load balancer that can’t do HTTP properly either? Well, it doesn't exactly advertise that on the tin, no

> Why would you expect TLS to work correctly on a HTTP load balancer that can’t do HTTP properly either? Well, it doesn't exactly advertise that on the tin, now does it? And we're not using it as a security product (I know there are people out there after "WAF"s and … stuff … but that's not us); AFAICT, it is Azure's offering equivalent to AWS's ELB. (It is tempting to remove it from the architecture, but unfortunately, we're integrating with a third-party in this case that wants it that way. Everywhere else we need an HTTP proxy we use nginx…)

jiggawatts 4y ago
Most of my clients are big enterprise, and they insist on ticking the "WAF" checkbox. Unfortunately, App Gateway is pretty much the only Azure-native option for this. Front Door also has a WAF module, but it's even worse. Microsoft markets both as "security" products. Speaking of Front Door: it's a CDN, TCP accelerator, and TLS offload performance product that slowed down web site performance in every test that I've ever done with it. It doesn't even begin to approach the features of some of its competitors. For example it still can't do HTTP/3 or TLS v1.3. Or Brotli, or ZStandard, or multi path TCP, or anything really that helps performance.