Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
TLS termination proxy
open-in-new
<h2 id="uses">Uses</h2> <p>TLS termination proxies can be used to: </p> <ul><li>secure <a href="/facts/Plaintext/tWnBDCgE">plaintext</a> communications over untrusted networks by tunnelling them in (D)TLS,</li> <li>allow inspection of encrypted traffic by an <a href="/facts/Intrusion_detection_system/mAw24Fyo">intrusion detection system</a> to detect and block malicious activities,</li> <li>allow <a href="/facts/Computer_and_network_surveillance/kAom0Xn0">network surveillance</a> and analyze encrypted traffic,</li> <li>enable otherwise unsupported integration with other applications that provide additional capabilities such as <a href="/facts/Content-control_software/bHoW65eY">content filtering</a> or <a href="/facts/Hardware_security_module/dhpo8qoR">Hardware security module</a>,</li> <li>enable (D)TLS protocol versions, extensions, or capabilities (e.g. <a href="/facts/OCSP_stapling/oGL6wQYc">OCSP stapling</a>, <a href="/facts/Application-Layer_Protocol_Negotiation/Hy5Y3tWu">ALPN</a>, <a href="/facts/DNS-based_Authentication_of_Named_Entities/I6X5h9P7">DANE</a>, <a href="/facts/Certificate_Transparency/tcW3lqm7">CT</a> validation, etc.) unsupported by client or server applications to enhance their compatibility and/or security,</li> <li>work around <a href="/facts/Software_bug/I1uSXySv">buggy</a>/insecure (D)TLS implementations in client or server applications to improve their compatibility and/or security,</li> <li>provide additional <a href="/facts/Transport_Layer_Security/pGy16TnA">certificate-based authentication</a> unsupported by server and/or client applications or protocols,</li> <li>provide an additional <a href="/facts/Defense_in_depth_(computing)/4DWLv5xk">defence-in-depth</a> layer for centralised control and consistent management of (D)TLS configuration and associated security policies, and</li> <li>reduce the <a href="/facts/Load_(computing)/J2v5XarQ">load</a> on the main servers by <a href="/facts/Computation_offloading/rLkJv9UF">offloading</a> the cryptographic processing to another machine.</li></ul> <h2 id="types">Types</h2> <p>TLS termination proxies can provide three connectivity patterns:<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> </p> <ul><li>TLS Offloading of inbound encrypted (D)TLS connection from a client and forwarding communications over a plain text connection to the server.</li> <li>TLS Encryption of inbound plaintext connection from a client and forwarding communications over an encrypted (D)TLS connection to the server.</li> <li>TLS Bridging of two encrypted (D)TLS connections to allow inspection and filtering of encrypted traffic by decrypting inbound (D)TLS connection from a client and re-encrypting it with another (D)TLS connection to the server.</li></ul> <p>Combining a TLS Encrypting proxy in front of a client with a TLS Offloading proxy in front of a server, can allow (D)TLS encryption and authentication for protocols and applications that don't otherwise support it, with two proxies maintaining a secure (D)TLS tunnel over untrusted network segments between client and server. </p><p>A proxy used by clients as an intermediary gateway for all outbound connections is typically called a <a href="/facts/Forward_proxy/ArhwQE74">Forward proxy</a>, while a proxy used by servers as an intermediary gateway for all inbound connections is typically called a <a href="/facts/Reverse_proxy/bN4HFUEC">Reverse proxy</a>. Forward TLS bridging proxies that allow intrusion detection system to analyse all client traffic are typically marketed as "SSL Forward Proxy".<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a><a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a><a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p><p>TLS Offloading and TLS Bridging proxies typically need to authenticate themselves to clients with a digital certificate using either <a href="/facts/X.509/rs0JuYDd">PKIX</a> or DANE authentication. Usually the server operator supplies to its reverse proxy a valid certificate for use during (D)TLS handshake with clients. A forward proxy operator, however would need to create their own private <a href="/facts/Certificate_authority/WAo8vMTN">CA</a>, install it into the trust store of all clients and have the proxy generate a new certificate signed by the private CA in real time for each server that a client tries to connect to. </p><p>When network traffic between client and server is routed via a proxy, it can operate in <a href="/facts/Proxy_server/ArhwQE74">transparent</a> mode by using the client's <a href="/facts/IP_address/z9V22Sw9">IP address</a> instead of its own when connecting to the server and using the server's IP address when responding to the client. If a Transparent TLS Bridging Proxy has a valid server certificate, neither client nor server would be able to detect the proxy presence. An adversary that has compromised the private key of the server's digital certificate or is able to use a compromised/coerced PKIX CAs to issue a new valid certificate for the server, could perform a <a href="/facts/Man-in-the-middle_attack/dx4cojdz">man-in-the-middle attack</a> by routing TLS traffic between client and server through a Transparent TLS Bridging Proxy and would have the ability to copy decrypted communications, including logon credentials, and modify content of communications on the fly without being detected. </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/TLS_acceleration/cezn2K9o">TLS acceleration</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>"What is SSL Termination?". F5 Networks. Archived from the original on 2024-06-08. Retrieved 2024-06-08. <a href="https://www.f5.com/glossary/ssl-termination" target="_blank">https://www.f5.com/glossary/ssl-termination</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"Setup IIS with URL Rewrite as a reverse proxy". Microsoft. 25 August 2016. Archived from the original on 15 August 2022. Retrieved 8 June 2024. <a href="https://docs.microsoft.com/fr-fr/archive/blogs/friis/setup-iis-with-url-rewrite-as-a-reverse-proxy-for-real-world-apps" target="_blank">https://docs.microsoft.com/fr-fr/archive/blogs/friis/setup-iis-with-url-rewrite-as-a-reverse-proxy-for-real-world-apps</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"Infrastructure Layouts Involving TLS". HAProxy Technologies. <a href="https://www.haproxy.com/documentation/hapee/latest/deployment-guides/tls-infrastructure/" target="_blank">https://www.haproxy.com/documentation/hapee/latest/deployment-guides/tls-infrastructure/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>"SSL Forward Proxy Overview". Juniper Networks. 2023-10-16. Archived from the original on 2024-06-08. Retrieved 2024-06-08. <a href="https://www.juniper.net/documentation/us/en/software/nm-apps23.1/junos-space-security-director/topics/concept/junos-space-ssl-forward-proxy-overview.html" target="_blank">https://www.juniper.net/documentation/us/en/software/nm-apps23.1/junos-space-security-director/topics/concept/junos-space-ssl-forward-proxy-overview.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>"SSL Forward Proxy". Palo Alto Networks. Archived from the original on 2017-12-01. Retrieved 2017-11-24. <a href="https://web.archive.org/web/20171201081116/https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/ssl-forward-proxy" target="_blank">https://web.archive.org/web/20171201081116/https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/decryption/ssl-forward-proxy</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>"Overview: SSL forward proxy client and server authentication". F5 Networks. Archived from the original on 2024-06-08. Retrieved 2017-11-24. <a href="https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-11-6-0/13.html" target="_blank">https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-11-6-0/13.html</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> </ol>