What is SSL offloading (termination), and how is it set up?

Short answer

SSL offloading (termination) is the termination of the client's TLS connection on TR7 instead of on the Backend Service: the certificate resides on TR7, and TR7 decrypts the traffic. In TR7, HTTP/1.1 or HTTP/2 from the Encrypted (HTTPS) group is selected in the Protocol field of the frontend row of the HTTP vService, or TCP + TLS on the L7 TCP vService, and the certificate is selected in the Certificate field and the vService is saved. The connection from TR7 to the Backend Service is unencrypted by default; for that connection to be encrypted as well, SSL Service is turned on in the Backend Service (What is SSL bridging; how do I also encrypt the traffic to the backend?).

How Does It Work?

1. The client connects to the encrypted frontend row of the vService; TR7 performs the TLS handshake and presents the certificate that matches the domain name the client requests (SNI).
2. TR7 decrypts the traffic. On the HTTP vService, the request is processed as HTTP; WAF, Conditions, Actions, Cache and Compression work on the content. On the L7 TCP vService, the decrypted traffic is forwarded as a byte stream.
3. TR7 opens its own connection to the Backend Service. If SSL Service is off in the Backend Service (default), this connection is unencrypted; if it is on, TR7 sets up a new TLS connection to the server.

How Is It Done?

The steps below are for the HTTP vService; on the L7 TCP vService, Protocol = TCP + TLS is selected in step 5.

1

Adım 1 Open the certificate add form (if needed)

If the certificate to be used does not exist on TR7, Add is clicked on the Certificates & PKI → SSL/TLS Certificates screen (how to add).

2

Adım 2 Define the certificate (if needed)

The Certificate Name is entered; for separate PEM files, Type = Manual is selected and Certificate Content and Key Content are entered; for a PKCS#12 file, Type = PFX is selected and the file and its password are entered (How do I upload my certificate to TR7; which formats are supported?).

3

Adım 3 Save the certificate (if needed)

Add at the bottom of the form is clicked; the certificate is added to the list.

4

Adım 4 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is selected and Edit is clicked.

5

Adım 5 Define the encrypted frontend row

In the row in the Frontend list, Port = 443 and Protocol = HTTP/2 (or HTTP/1.1) from the Encrypted (HTTPS) group are selected.

6

Adım 6 Select the certificate

The certificate is selected in the Certificate field that appears when an encrypted row is selected; if no certificate is selected, the row listens unencrypted.

7

Adım 7 Save

Save is clicked. In a cluster setup, with the default auto-sync, the change is also sent to the peer device; if Manual Sync Mode is on, it is sent to the peer device manually.

For TLS versions and ciphers, a profile is selected in the SSL Security module in the Details panel of the vService; for redirecting the requests coming from port 80 to HTTPS, see the How do I redirect HTTP to HTTPS? page.

In TR7

vService	How
HTTP	In the frontend row, HTTP/1.1 or HTTP/2 (optionally their variants with the HTTP/3 badge) from the Encrypted (HTTPS) group is selected in the Protocol field; the certificate is selected in the Certificate field
L7 TCP	In the frontend row, TCP + TLS in the Encrypted (TLS) group is selected in the Protocol field; the certificate is selected in the Certificate field
Network	TLS is not terminated; there is no Protocol field in the frontend row

• The Certificate field appears in the form when an encrypted protocol is selected in at least one frontend row.
• TLS versions and ciphers are determined by the profile selected in the SSL Security module in the Details panel of the vService. When the module is checked, Default Profile comes selected; in this profile, the lowest version is TLSv1.1 and the cipher set is Only Secure Ones (Default Profile).
• The certificate itself is first added on the Certificates & PKI → SSL/TLS Certificates screen (How do I upload my certificate to TR7; which formats are supported?).

Common Misconceptions

• "Selecting the encrypted protocol is enough." If no certificate is selected in the Certificate field, the row does not terminate TLS and listens unencrypted; the form does not prevent saving.
• "Offloading also encrypts the traffic to the Backend Service." By default, it does not. For this, SSL Service is turned on in the Backend Service; this configuration is SSL bridging.
• "When TLS is terminated on L7 TCP, WAF also works." WAF, Cache, Compression and HTTP header actions exist only on the HTTP vService; on L7 TCP, even though TLS is decrypted, the content is not processed as HTTP.
• "Protocol applies to the whole vService." Each frontend row has its own Protocol value; if the row with port 80 is left as HTTP, the site also remains accessible unencrypted. For redirection, HTTP → HTTPS is selected in that row (How do I redirect HTTP to HTTPS?).

How it is done in the documentation

• HTTP (L7) vService · Protocol
• HTTP (L7) vService · Certificate
• L7 TCP vService · SSL/TLS Termination
• Backend Services · SSL Service

Related questions

• How do I choose between termination, passthrough and bridging?
• How do I upload my certificate to TR7; which formats are supported?
• How do I redirect HTTP to HTTPS?