SSL/TLS termination in AWS - Step-by-Step Execution

Process Flow - SSL/TLS termination

Client sends HTTPS request

↓

Load Balancer receives request

↓

Load Balancer decrypts SSL/TLS

↓

Forward plain HTTP request to backend

↓

Backend processes HTTP request

↓

Response sent back through Load Balancer

↓

Load Balancer encrypts response with SSL/TLS

↓

Client receives HTTPS response

SSL/TLS termination means the load balancer decrypts secure traffic, then sends plain traffic to backend servers.

Execution Sample

AWS

1. Client -> HTTPS request to Load Balancer
2. Load Balancer decrypts SSL/TLS
3. Load Balancer -> HTTP request to backend
4. Backend processes request
5. Backend -> response to Load Balancer
6. Load Balancer encrypts response
7. Client receives HTTPS response

This flow shows how SSL/TLS termination works at a load balancer in AWS.

Process Table

Step	Action	Input	Output	Notes
1	Client sends HTTPS request	HTTPS request with SSL/TLS	Encrypted request	Client initiates secure connection
2	Load Balancer receives request	Encrypted request	Encrypted request	Load Balancer listens on port 443
3	Load Balancer decrypts SSL/TLS	Encrypted request	Plain HTTP request	SSL certificate used to decrypt
4	Load Balancer forwards HTTP request	Plain HTTP request	Plain HTTP request	Sends to backend on port 80
5	Backend processes request	Plain HTTP request	HTTP response	Backend handles request normally
6	Load Balancer receives response	HTTP response	HTTP response	Load Balancer gets backend response
7	Load Balancer encrypts response	HTTP response	Encrypted HTTPS response	Encrypts response with SSL/TLS
8	Client receives HTTPS response	Encrypted HTTPS response	Decrypted response	Client decrypts and displays content
9	End	N/A	N/A	Request cycle complete

💡 Request cycle ends after client receives decrypted HTTPS response

Status Tracker

Variable	Start	After Step 3	After Step 4	After Step 7	Final
Request	Encrypted HTTPS	Plain HTTP	Plain HTTP	Encrypted HTTPS	Decrypted HTTPS at client
Response	N/A	N/A	HTTP response	Encrypted HTTPS	Decrypted HTTPS at client

Key Moments - 3 Insights

Why does the load balancer decrypt the request before sending it to the backend?

Because the backend usually expects plain HTTP traffic, so the load balancer must remove SSL/TLS encryption first (see step 3 and 4 in execution_table).

Does the backend server handle encrypted traffic in SSL/TLS termination?

No, the backend receives plain HTTP traffic because the load balancer already decrypted it (see step 4 and 5 in execution_table).

How does the client get a secure response if the backend uses plain HTTP?

The load balancer encrypts the backend's plain HTTP response before sending it back to the client (see step 7 and 8 in execution_table).

Visual Quiz - 3 Questions

Look at the execution_table, what is the state of the request after step 3?

A Plain HTTP request

B Encrypted HTTPS request

C Encrypted HTTP response

D Plain HTTPS response

💡 Hint

Check the 'Output' column for step 3 in execution_table.

At which step does the load balancer encrypt the response back to the client?

A Step 4

B Step 7

C Step 5

D Step 8

💡 Hint

Look for 'Load Balancer encrypts response' in the 'Action' column.

If the backend was configured to use HTTPS instead of HTTP, how would the execution_table change?

A Load balancer would not decrypt the request at step 3

B Backend would receive encrypted HTTPS request

C All of the above

D Load balancer would forward encrypted request to backend

💡 Hint

Consider how SSL/TLS termination changes if backend expects HTTPS.

Concept Snapshot

SSL/TLS termination means the load balancer decrypts incoming HTTPS requests.
It forwards plain HTTP requests to backend servers.
Backend processes plain HTTP traffic.
Load balancer encrypts responses before sending back.
This offloads encryption work from backend and centralizes SSL management.

Full Transcript

SSL/TLS termination is when a load balancer handles decrypting secure HTTPS traffic from clients. The client sends an encrypted HTTPS request to the load balancer. The load balancer uses its SSL certificate to decrypt the request, turning it into plain HTTP. It then forwards this plain HTTP request to the backend servers. The backend processes the request as normal HTTP traffic and sends back a plain HTTP response. The load balancer receives this response and encrypts it again using SSL/TLS before sending it back to the client. This process allows backend servers to avoid the overhead of encryption and simplifies certificate management by centralizing it at the load balancer.