4 ms·
Hmm, good point. I guess it's a shame we can't pass TLS connection state between processes as easily as socket handles?
by nly 13y ago
Hmm, good point. I guess it's a shame we can't pass TLS connection state between processes as easily as socket handles?
- e12e 13y agoOne approach is to let one process do the ssl termination, and only that -- that raises the bar some. That process might be nginx -- running under a different uid -- or one of the many ssl-proxies.
- bigiain 13y agoI guess that's a big advantage of terminating SSL at the load balancers – dedicated hardware which is unlikely to end up with exploitable RoR/PHP or SQLi vulnerabilites – is probably somewhat less likely to lose your private TLS certs to an automated WordPress/Rails/cPanel/whatever zero-day scan...