SSL/TLS termination in AWS - Step-by-Step Execution

Process Flow - SSL/TLS termination

Client sends HTTPS request

↓

Load Balancer receives request

↓

Load Balancer decrypts SSL/TLS

↓

Forward plain HTTP request to backend

↓

Backend processes HTTP request

↓

Response sent back through Load Balancer

↓

Load Balancer encrypts response with SSL/TLS

↓

Client receives HTTPS response

SSL/TLS termination means the load balancer decrypts secure traffic, then sends plain traffic to backend servers.

Execution Sample

AWS

1. Client -> HTTPS request to Load Balancer
2. Load Balancer decrypts SSL/TLS
3. Load Balancer -> HTTP request to backend
4. Backend processes request
5. Backend -> response to Load Balancer
6. Load Balancer encrypts response
7. Client receives HTTPS response

This flow shows how SSL/TLS termination works at a load balancer in AWS.

Process Table

Step	Action	Input	Output	Notes
1	Client sends HTTPS request	HTTPS request with SSL/TLS	Encrypted request	Client initiates secure connection
2	Load Balancer receives request	Encrypted request	Encrypted request	Load Balancer listens on port 443
3	Load Balancer decrypts SSL/TLS	Encrypted request	Plain HTTP request	SSL certificate used to decrypt
4	Load Balancer forwards HTTP request	Plain HTTP request	Plain HTTP request	Sends to backend on port 80
5	Backend processes request	Plain HTTP request	HTTP response	Backend handles request normally
6	Load Balancer receives response	HTTP response	HTTP response	Load Balancer gets backend response
7	Load Balancer encrypts response	HTTP response	Encrypted HTTPS response	Encrypts response with SSL/TLS
8	Client receives HTTPS response	Encrypted HTTPS response	Decrypted response	Client decrypts and displays content
9	End	N/A	N/A	Request cycle complete

💡 Request cycle ends after client receives decrypted HTTPS response

Status Tracker

Variable	Start	After Step 3	After Step 4	After Step 7	Final
Request	Encrypted HTTPS	Plain HTTP	Plain HTTP	Encrypted HTTPS	Decrypted HTTPS at client
Response	N/A	N/A	HTTP response	Encrypted HTTPS	Decrypted HTTPS at client

Key Moments - 3 Insights

Why does the load balancer decrypt the request before sending it to the backend?

Because the backend usually expects plain HTTP traffic, so the load balancer must remove SSL/TLS encryption first (see step 3 and 4 in execution_table).

Does the backend server handle encrypted traffic in SSL/TLS termination?

No, the backend receives plain HTTP traffic because the load balancer already decrypted it (see step 4 and 5 in execution_table).

How does the client get a secure response if the backend uses plain HTTP?

The load balancer encrypts the backend's plain HTTP response before sending it back to the client (see step 7 and 8 in execution_table).

Visual Quiz - 3 Questions

Look at the execution_table, what is the state of the request after step 3?

A Plain HTTP request

B Encrypted HTTPS request

C Encrypted HTTP response

D Plain HTTPS response

💡 Hint

Check the 'Output' column for step 3 in execution_table.

At which step does the load balancer encrypt the response back to the client?

A Step 4

B Step 7

C Step 5

D Step 8

💡 Hint

Look for 'Load Balancer encrypts response' in the 'Action' column.

If the backend was configured to use HTTPS instead of HTTP, how would the execution_table change?

A Load balancer would not decrypt the request at step 3

B Backend would receive encrypted HTTPS request

C All of the above

D Load balancer would forward encrypted request to backend

💡 Hint

Consider how SSL/TLS termination changes if backend expects HTTPS.

Concept Snapshot

SSL/TLS termination means the load balancer decrypts incoming HTTPS requests.
It forwards plain HTTP requests to backend servers.
Backend processes plain HTTP traffic.
Load balancer encrypts responses before sending back.
This offloads encryption work from backend and centralizes SSL management.

Full Transcript

SSL/TLS termination is when a load balancer handles decrypting secure HTTPS traffic from clients. The client sends an encrypted HTTPS request to the load balancer. The load balancer uses its SSL certificate to decrypt the request, turning it into plain HTTP. It then forwards this plain HTTP request to the backend servers. The backend processes the request as normal HTTP traffic and sends back a plain HTTP response. The load balancer receives this response and encrypts it again using SSL/TLS before sending it back to the client. This process allows backend servers to avoid the overhead of encryption and simplifies certificate management by centralizing it at the load balancer.

Practice

1. What is the main purpose of SSL/TLS termination on an AWS load balancer?

easy

A. To store SSL certificates on backend servers

B. To decrypt incoming HTTPS traffic before sending it to backend servers

C. To encrypt traffic between backend servers

D. To disable HTTPS on the load balancer

Solution

1. Step 1: Understand SSL/TLS termination role

   SSL/TLS termination means the load balancer decrypts HTTPS traffic so backend servers receive plain HTTP.

2. Step 2: Identify where decryption happens

   The load balancer handles the SSL certificates and decrypts traffic, simplifying backend server setup.

3. Final Answer:

   To decrypt incoming HTTPS traffic before sending it to backend servers -> Option B

4. Quick Check:

   SSL/TLS termination = decrypt at load balancer [OK]

Hint: SSL termination means decrypt at load balancer, not backend [OK]

Common Mistakes:

• Thinking backend servers handle SSL decryption
• Confusing encryption with decryption location
• Assuming SSL certificates must be on backend servers

2. Which AWS load balancer listener configuration correctly enables SSL/TLS termination?

easy

A. Listener protocol HTTP on port 80 with SSL certificate attached

B. Listener protocol TCP on port 443 without SSL certificate

C. Listener protocol HTTPS on port 443 with SSL certificate attached

D. Listener protocol HTTPS on port 80 without SSL certificate

Solution

1. Step 1: Identify correct protocol and port for SSL termination

   HTTPS protocol on port 443 is standard for SSL/TLS termination.

2. Step 2: Confirm SSL certificate attachment

   SSL certificate must be attached to the HTTPS listener to enable termination.

3. Final Answer:

   Listener protocol HTTPS on port 443 with SSL certificate attached -> Option C

4. Quick Check:

   HTTPS + port 443 + cert = SSL termination [OK]

Hint: SSL termination needs HTTPS listener on port 443 with cert [OK]

Common Mistakes:

• Using HTTP protocol with SSL certificate
• Using wrong port for HTTPS
• Not attaching SSL certificate to listener

3. Given this AWS Application Load Balancer listener configuration:
Listener: HTTPS on port 443 with SSL certificate
What happens if a client sends an HTTP request to port 80?

medium

A. The request is forwarded to backend servers without encryption

B. The request is accepted as plain HTTP without encryption

C. The request is automatically redirected to HTTPS on port 443

D. The request is rejected with a connection error

Solution

1. Step 1: Check listener configuration for port 80

   No listener is defined on port 80, so the load balancer does not accept HTTP requests.

2. Step 2: Understand behavior without HTTP listener

   Without an HTTP listener, requests to port 80 fail with connection errors.

3. Final Answer:

   The request is rejected with a connection error -> Option D

4. Quick Check:

   No HTTP listener = connection error on port 80 [OK]

Hint: No HTTP listener means HTTP requests fail, no redirect [OK]

Common Mistakes:

• Assuming automatic HTTP to HTTPS redirect without listener
• Thinking HTTP requests are accepted without encryption
• Confusing backend server behavior with load balancer

4. You configured an AWS load balancer with an HTTPS listener on port 443 and attached a valid SSL certificate. However, clients report SSL errors when connecting. What is the most likely cause?

medium

A. The SSL certificate is expired or not trusted by clients

B. The load balancer listener is set to HTTP instead of HTTPS

C. Backend servers do not support HTTPS

D. The load balancer is missing a target group

Solution

1. Step 1: Verify SSL certificate validity

   SSL errors often occur if the certificate is expired or not trusted by client browsers.

2. Step 2: Check listener and backend setup

   Listener is HTTPS with certificate attached, so listener config is correct; backend HTTPS support is optional after termination.

3. Final Answer:

   The SSL certificate is expired or not trusted by clients -> Option A

4. Quick Check:

   SSL errors usually mean bad or expired cert [OK]

Hint: SSL errors usually mean certificate issues [OK]

Common Mistakes:

• Assuming backend HTTPS affects client SSL errors
• Confusing listener protocol with certificate validity
• Ignoring certificate expiration or trust chain

5. You want to ensure all HTTP traffic to your AWS Application Load Balancer is securely redirected to HTTPS. Which configuration achieves this best?

hard

A. Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443

B. Create an HTTPS listener on port 443 and disable HTTP listener

C. Configure backend servers to redirect HTTP to HTTPS

D. Attach SSL certificates to backend servers only

Solution

1. Step 1: Understand how to redirect HTTP to HTTPS at load balancer

   Creating an HTTP listener on port 80 that redirects to HTTPS ensures all HTTP requests become secure.

2. Step 2: Evaluate other options

   Disabling HTTP listener blocks HTTP requests; backend redirects add latency and complexity; attaching certs only to backend does not redirect.

3. Final Answer:

   Create an HTTP listener on port 80 that redirects all requests to HTTPS on port 443 -> Option A

4. Quick Check:

   HTTP listener with redirect = secure all traffic [OK]

Hint: Use HTTP listener redirect to HTTPS for secure traffic [OK]

Common Mistakes:

• Disabling HTTP listener without redirect
• Relying on backend servers for redirects
• Not attaching SSL cert to load balancer listener