SSL/TLS and Certificates

TLS termination, certificate management and the effect of encrypted traffic on resource usage.

• What is SSL offloading (termination), and how is it set up?LB-08-001
• How do I upload my certificate to TR7; which formats are supported?LB-08-002
• How do I redirect HTTP to HTTPS?LB-08-003
• Can I use a wildcard certificate?LB-08-004
• How do I get a warning before a certificate expires?LB-08-005
• What is SSL passthrough; when should I use passthrough instead of termination?LB-08-006
• What is SSL bridging; how do I also encrypt the traffic to the backend?LB-08-007
• How do I choose between termination, passthrough and bridging?LB-08-008
• How do I add the intermediate certificate chain?LB-08-009
• Can I manage Private Keys separately (Private Key Library)?LB-08-010
• Can I create a CSR on TR7?LB-08-011
• Can I get certificates automatically with Let's Encrypt / ACME?LB-08-012
• Can I attach more than one certificate to a vService; how is the right certificate selected (SNI)?LB-08-013
• When I renew a certificate, do I need to replace it on each vService one by one?LB-08-014
• What is a TLS Security Profile, and what does it configure?LB-08-015
• How do I disable TLS 1.0/1.1; is TLS 1.3 supported?LB-08-016
• How do I disable weak ciphers?LB-08-017
• How do I add HSTS?LB-08-018
• After switching to HTTPS, pages show a "mixed content" warning; how do I fix it?LB-08-019
• The browser says "certificate not trusted"; what are the possible causes?LB-08-020
• How do I tell if the certificate chain is incomplete?LB-08-021
• My backend uses a self-signed certificate; is that a problem?LB-08-022
• Which DNS providers are supported for the ACME DNS challenge?LB-08-023
• Can I import/export cipher lists?LB-08-024
• What should I do to get an A+ from SSL Labs?LB-08-025
• Can I authenticate clients with client certificates (mTLS)?LB-08-026
• How do I add my own internal CA to TR7?LB-08-027
• Can I verify the backend certificate when connecting to the backend over HTTPS?LB-08-028
• I need to send SNI when connecting to the backend; how do I set it up?LB-08-029
• Is there a difference between TCP + TLS termination on L7 TCP and termination on an HTTP vService?LB-08-030
• With passthrough, can I route to different backends based on SNI?LB-08-031
• Can I route or block traffic based on TLS version or cipher?LB-08-032
• How do I filter certificates that have expired or are about to expire (Expiry Health)?LB-08-033
• What does the vService do if the certificate I uploaded has an error?LB-08-034
• Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?LB-08-035
• What is the difference between HTTP-01 and DNS-01 in ACME; why is DNS-01 required for wildcards?LB-08-036
• Is OCSP Stapling supported?LB-08-037
• Is post-quantum key exchange supported?LB-08-038
• Can I reject requests whose SNI and Host Header do not match (domain fronting) (SNI/Host Validation)?LB-08-039