SSL/TLS termination in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is SSL/TLS termination?

SSL/TLS termination is the process where encrypted traffic is decrypted at a specific point, usually at a load balancer or proxy, before it reaches the backend servers.

beginner

Why do we use SSL/TLS termination in cloud infrastructure?

We use SSL/TLS termination to offload the work of decrypting traffic from backend servers, improving performance and simplifying certificate management.

beginner

Where does SSL/TLS termination typically happen in AWS?

In AWS, SSL/TLS termination typically happens at the Elastic Load Balancer (ELB), such as Application Load Balancer (ALB) or Classic Load Balancer.

intermediate

What is the difference between SSL/TLS termination and SSL/TLS passthrough?

SSL/TLS termination decrypts traffic at the load balancer, while SSL/TLS passthrough sends encrypted traffic directly to backend servers without decrypting it first.

beginner

What AWS service can manage SSL/TLS certificates for termination?

AWS Certificate Manager (ACM) can provision, manage, and deploy SSL/TLS certificates for use with AWS services like ELB.

Where does SSL/TLS termination usually occur in AWS?

A At the Elastic Load Balancer

B Directly on backend EC2 instances

C On the client device

D In the AWS S3 bucket

SSL/TLS termination typically happens at the Elastic Load Balancer to offload decryption from backend servers.

What is the main benefit of SSL/TLS termination?

A Disables encryption for faster traffic

B Encrypts traffic between client and load balancer

C Stores certificates in backend servers

D Improves backend server performance by offloading decryption

SSL/TLS termination improves backend performance by handling decryption at the load balancer.

Which AWS service helps manage SSL/TLS certificates for termination?

A Amazon S3

B AWS Lambda

C AWS Certificate Manager (ACM)

D AWS CloudTrail

AWS Certificate Manager (ACM) manages SSL/TLS certificates for AWS services.

What happens in SSL/TLS passthrough?

A Traffic is unencrypted from client to backend

B Encrypted traffic is sent directly to backend servers without decryption

C Traffic is decrypted at the load balancer

D Certificates are terminated at the client

In passthrough, encrypted traffic passes through the load balancer to backend servers without decryption.

Why might you choose SSL/TLS passthrough over termination?

A To keep encryption end-to-end between client and backend

B To improve load balancer performance

C To simplify certificate management

D To reduce backend server load

Passthrough keeps encryption from client all the way to backend servers for end-to-end security.

Explain what SSL/TLS termination is and why it is used in cloud infrastructure.

Think about where encrypted traffic is decrypted and how it helps servers.

Describe the difference between SSL/TLS termination and SSL/TLS passthrough in AWS.

Consider where the encrypted traffic is decrypted in each case.

Practice

1. What is the main purpose of SSL/TLS termination on an AWS load balancer?

easy

A. To store SSL certificates on backend servers

B. To decrypt incoming HTTPS traffic before sending it to backend servers

C. To encrypt traffic between backend servers

D. To disable HTTPS on the load balancer

Solution

1. Step 1: Understand SSL/TLS termination role

   SSL/TLS termination means the load balancer decrypts HTTPS traffic so backend servers receive plain HTTP.

2. Step 2: Identify where decryption happens

   The load balancer handles the SSL certificates and decrypts traffic, simplifying backend server setup.

3. Final Answer:

   To decrypt incoming HTTPS traffic before sending it to backend servers -> Option B

4. Quick Check:

   SSL/TLS termination = decrypt at load balancer [OK]

Hint: SSL termination means decrypt at load balancer, not backend [OK]

Common Mistakes:

• Thinking backend servers handle SSL decryption
• Confusing encryption with decryption location
• Assuming SSL certificates must be on backend servers

2. Which AWS load balancer listener configuration correctly enables SSL/TLS termination?

easy

A. Listener protocol HTTP on port 80 with SSL certificate attached

B. Listener protocol TCP on port 443 without SSL certificate

C. Listener protocol HTTPS on port 443 with SSL certificate attached

D. Listener protocol HTTPS on port 80 without SSL certificate

Solution

1. Step 1: Identify correct protocol and port for SSL termination

   HTTPS protocol on port 443 is standard for SSL/TLS termination.

2. Step 2: Confirm SSL certificate attachment

   SSL certificate must be attached to the HTTPS listener to enable termination.

3. Final Answer:

   Listener protocol HTTPS on port 443 with SSL certificate attached -> Option C

4. Quick Check:

   HTTPS + port 443 + cert = SSL termination [OK]

Hint: SSL termination needs HTTPS listener on port 443 with cert [OK]

Common Mistakes:

• Using HTTP protocol with SSL certificate
• Using wrong port for HTTPS
• Not attaching SSL certificate to listener

3. Given this AWS Application Load Balancer listener configuration:
Listener: HTTPS on port 443 with SSL certificate
What happens if a client sends an HTTP request to port 80?

medium

A. The request is forwarded to backend servers without encryption

B. The request is accepted as plain HTTP without encryption

C. The request is automatically redirected to HTTPS on port 443

D. The request is rejected with a connection error

Solution

1. Step 1: Check listener configuration for port 80

   No listener is defined on port 80, so the load balancer does not accept HTTP requests.

2. Step 2: Understand behavior without HTTP listener

   Without an HTTP listener, requests to port 80 fail with connection errors.

3. Final Answer:

   The request is rejected with a connection error -> Option D

4. Quick Check:

   No HTTP listener = connection error on port 80 [OK]

Hint: No HTTP listener means HTTP requests fail, no redirect [OK]

Common Mistakes:

• Assuming automatic HTTP to HTTPS redirect without listener
• Thinking HTTP requests are accepted without encryption
• Confusing backend server behavior with load balancer

4. You configured an AWS load balancer with an HTTPS listener on port 443 and attached a valid SSL certificate. However, clients report SSL errors when connecting. What is the most likely cause?

medium

A. The SSL certificate is expired or not trusted by clients

B. The load balancer listener is set to HTTP instead of HTTPS

C. Backend servers do not support HTTPS

D. The load balancer is missing a target group

Solution

1. Step 1: Verify SSL certificate validity

   SSL errors often occur if the certificate is expired or not trusted by client browsers.

2. Step 2: Check listener and backend setup

   Listener is HTTPS with certificate attached, so listener config is correct; backend HTTPS support is optional after termination.

3. Final Answer:

   The SSL certificate is expired or not trusted by clients -> Option A

4. Quick Check:

   SSL errors usually mean bad or expired cert [OK]

Hint: SSL errors usually mean certificate issues [OK]

Common Mistakes:

• Assuming backend HTTPS affects client SSL errors
• Confusing listener protocol with certificate validity
• Ignoring certificate expiration or trust chain

5. You want to ensure all HTTP traffic to your AWS Application Load Balancer is securely redirected to HTTPS. Which configuration achieves this best?

hard

A. Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443

B. Create an HTTPS listener on port 443 and disable HTTP listener

C. Configure backend servers to redirect HTTP to HTTPS

D. Attach SSL certificates to backend servers only

Solution

1. Step 1: Understand how to redirect HTTP to HTTPS at load balancer

   Creating an HTTP listener on port 80 that redirects to HTTPS ensures all HTTP requests become secure.

2. Step 2: Evaluate other options

   Disabling HTTP listener blocks HTTP requests; backend redirects add latency and complexity; attaching certs only to backend does not redirect.

3. Final Answer:

   Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443 -> Option A

4. Quick Check:

   HTTP listener with redirect = secure all traffic [OK]

Hint: Use HTTP listener redirect to HTTPS for secure traffic [OK]

Common Mistakes:

• Disabling HTTP listener without redirect
• Relying on backend servers for redirects
• Not attaching SSL cert to load balancer listener