FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Intermediate

What does the SSL Service option do; what is needed to connect to the backend over an encrypted connection? ​

Short answer

When SSL Service is turned on, TR7 connects to the Backend Service with TLS; this way, traffic is encrypted between TR7 and the server just as it is between the client and TR7 (SSL bridging / re-encryption). The only thing needed is for the server to listen for TLS on the port in the Address field; since the default value of Certificate Verification is None, the server's certificate is not verified and self-signed certificates also work. As needed, certificate verification, TR7 presenting a client certificate to the server (mTLS), and a TLS version/cipher restriction with the Backend SSL Security Profile are added. SSL Service is applied on HTTP and L7 TCP vServices.

Problem: Why Does the Back Side Stay Unencrypted When TLS Is Terminated on TR7? ​

On HTTPS sites, TLS is usually terminated on TR7; TR7 reads and processes the request and, by default, forwards it to the Backend Service unencrypted. If the security policy requires encryption on the internal network as well, or if the Backend Service accepts only HTTPS, TR7 needs to connect to the server with TLS. How strict the connection will be (verifying the server's identity, TR7 identifying itself with a certificate, prohibiting old TLS versions) is determined by separate settings.

Solution: Four Methods ​

The methods are added on top of each other: Method 1 is required in every case, and the others are added as needed.

Your situationSuitable method
Traffic between TR7 and the server should be encryptedMethod 1: Encryption only
TR7 should also verify the server's certificateMethod 2: Connection with certificate verification
The server requests a client certificate from TR7Method 3: mTLS
The server should be connected to only with specific TLS versions and ciphersMethod 4: TLS security profile
  • How it works TR7 connects to the Backend Service with TLS; the server's certificate is not verified, and self-signed or expired certificates are also accepted.
  • Where it is openedLoad Balancer → Backend Services → Edit → SSL Service
  • Requirement The Backend Service listening for TLS on the defined port
  • vService type HTTP, L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Open the form

The Load Balancer → Backend Services steps are followed; the Backend Service is selected and Edit is clicked, or a new Backend Service form is opened with Add.

2
Adım 2 Write the TLS port

The server's TLS listening port (e.g. 443) is written in the port part of the Address field.

3
Adım 3 Turn on SSL Service

The SSL Service switch is turned on (its default value is off). When the switch is turned on, the SSL fields appear: Ciphers (default Standard), SNI, ALPN, Backend SSL Security Profile (default None), Certificate Verification (default None) and Client Certificate Presented to Backend (mTLS) (default None).

4
Adım 4 Optional: SNI and ALPN

If the server presents more than one certificate on the same IP, the server's name is written in the SNI field or a variable is selected with fx; SNI is sent only on an HTTP vService, and on an L7 TCP vService it is not sent even if the field is filled. If the server is to be connected to with HTTP/2, HTTP 2.0 Enabled is selected in the ALPN field; while the field is empty or HTTP 2.0 Disabled is selected, the server is connected to with HTTP/1.1.

5
Adım 5 Save

The Edit (Add for a new record) button at the bottom of the form is clicked. The vServices that use the Backend Service are reloaded with the new setting; open connections are not cut. While clustering is on and Manual Sync Mode is off (default), the setting is transferred to the peer device automatically.

Verification ​

1TLS on the server sideBackend Service side
Commandtcpdump -nn -A host 192.0.2.10 and port 443
ExpectedConnections from TR7 start with a TLS handshake; the request content cannot be read
On the TR7 side, the SSL Service row appears in the Backend Service's preview, and an amber lock icon appears in the name column of the list.

Method 2: Connection with Certificate Verification ​

  • How it works TR7 verifies the server's certificate against the selected certificate authority (CA); it does not connect to a server that cannot be verified.
  • Where it is opened Backend Service → SSL Service → Certificate Verification: Required → Verification CA Profile
  • Requirement The CA that signed the server certificate being defined on the Certificate Authorities (CA) screen under Certificates & PKI
  • vService type HTTP, L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Open the CA form (if needed)

If the root (and, if any, intermediate) CA that signed the server certificate is not defined in TR7, the CA record add form is opened with Certificates & PKI → Certificate Authorities (CA) → Add. If the CA is already defined, step 4 is next.

2
Adım 2 Enter the CA information

CA Name is required and unique; in the Operation field the default Add a trusted CA certificate is left, and the certificate is pasted or the file is dragged into the CA Certificate (PEM) field. Details: How do I add my own internal CA to TR7?

3
Adım 3 Save the CA

The Add button at the bottom of the form is clicked.

4
Adım 4 Turn on SSL Service

The Backend Service form is opened and the SSL Service switch is turned on (Method 1, steps 1–3).

5
Adım 5 Make verification required

Required is selected in the Certificate Verification field, and the CA from steps 1–3 is selected in the Verification CA Profile field that appears only with this selection.

6
Adım 6 Write the server name in SNI

The name in the server certificate is written in the SNI field; while verification is on, whether the certificate matches this name is also checked. SNI is applied only on an HTTP vService; on an L7 TCP vService, the certificate chain and validity period are verified, and the name match is not checked.

7
Adım 7 Save

The Edit (Add for a new record) button at the bottom of the form is clicked.

Verification ​

1Health and trafficTR7 side

The Health indicator of the Backend Service and the vService traffic are checked.

ExpectedTraffic goes to the verified server; a server with an invalid certificate is not connected to

Method 3: mTLS (TR7 Presenting a Client Certificate) ​

  • How it works When connecting to the server, TR7 identifies itself with a client certificate; the server accepts only connections that present this certificate.
  • Where it is opened Backend Service → SSL Service → Client Certificate Presented to Backend (mTLS)
  • Requirement A client certificate signed by a CA that the server trusts having been uploaded to TR7
  • vService type HTTP, L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Open the certificate form (if needed)

If the certificate TR7 will present does not exist yet, the certificate adding form is opened with Certificates & PKI → Client Certificates → Add. If the certificate is already defined, step 4 is next.

2
Adım 2 Enter the certificate information

Certificate Name is required and unique. If Import an existing certificate is selected in the How to Add field, Certificate (PEM) and Private Key (PEM) are entered (and Key passphrase (if encrypted) if the key is encrypted); if Issue from an internal CA is selected, Issuing CA, Certificate Profile and Person or Device (CN) are specified.

3
Adım 3 Save the certificate

The Add button at the bottom of the form is clicked. For the Backend Service to accept this certificate, it must trust the CA that issued the certificate.

4
Adım 4 Turn on SSL Service

The Backend Service form is opened and the SSL Service switch is turned on (Method 1, steps 1–3).

5
Adım 5 Select the certificate

The certificate from steps 1–3 is selected in the Client Certificate Presented to Backend (mTLS) field.

6
Adım 6 Save

The Edit (Add for a new record) button at the bottom of the form is clicked.

Verification ​

1Server logBackend Service side

The subject (DN) of the client certificate is seen in the server's TLS or access log.

ExpectedClient certificate: CN=tr7-backend-client …

Method 4: TLS Security Profile ​

  • How it works The minimum/maximum TLS version, cipher list and curve settings of the selected TLS security profile are applied to the connection TR7 opens to the server; frontend-specific fields such as client certificate verification have no effect here.
  • Where it is opened Backend Service → SSL Service → Backend SSL Security Profile
  • Requirement A suitable profile under Certificates & PKI → TLS Security Profiles
  • vService type HTTP, L7 TCP

Step-by-Step Configuration ​

1
Adım 1 Open the profile form (if needed)

The Backend SSL Security Profile field has no Default profile option; the field takes None or a defined profile. If there is no suitable profile, the profile form is opened with Certificates & PKI → TLS Security Profiles → Add (how to add); the same form also opens with the add button in the field's list in the Backend Service form. If the profile is already defined, step 4 is next.

2
Adım 2 Define the profile

Security Profile Name is required and unique; the form opens filled with the Default profile values. Only the minimum and maximum SSL version, cipher list and curve settings in the TLS Settings (Frontend & Backend) section are applied to the Backend Service connection. Profile creation details: How do I disable TLS 1.0/1.1; is TLS 1.3 supported?

3
Adım 3 Save the profile

The Add button at the bottom of the form is clicked.

4
Adım 4 Turn on SSL Service

The Backend Service form is opened and the SSL Service switch is turned on (Method 1, steps 1–3).

5
Adım 5 Select the profile

The profile is selected in the Backend SSL Security Profile field. When a profile is selected, the Ciphers field no longer has an effect; the cipher list comes from the profile.

6
Adım 6 Save

The Edit (Add for a new record) button at the bottom of the form is clicked.

Verification ​

1Negotiated TLS versionBackend Service side

The protocol and cipher information of the TR7 connections is checked in the server's TLS log.

ExpectedThe TLS version and cipher allowed in the profile

Common Mistakes ​

  • Selecting Required and leaving the CA profile empty. If no CA is selected or the CA's content is empty, verification is silently not performed; the connection is assumed to be verified.
  • Turning on SSL Service while the server listens unencrypted. TR7 starts a TLS handshake, the server cannot respond, and the connection cannot be established; requests return with an error. If the health check type is plain HTTP or TCP, the Backend Service can appear OK even in this case; while SSL Service is on, a type that probes with TLS (HTTPS, TCPS) is selected.
  • Changing the Ciphers field while a profile is selected. The field stays visible, but the cipher list comes from the profile.
  • Assuming Low cipher enables old TLS versions. Low only extends the cipher list; for an old server that requires TLS 1.0/1.1, a TLS security profile with a low minimum version is used.
  • Assuming the health check inherits every setting. Health check types that probe with TLS (HTTPS, TCPS, SMTPS, FTPS, LDAPS and SMTP with Use STARTTLS on) inherit the Backend Service's mTLS certificate, its CA while Required is selected, and the TLS security profile's minimum TLS version and cipher list (if Client Certificate to Present (mTLS) or Verification CA Profile is also selected separately in the health check profile, the selection in the profile applies); they do not inherit SNI, which comes from the Virtual Domain (Host/SNI) field in the health check profile.

How it is done in the documentation

Related questions