How do I choose between termination, passthrough and bridging?

Short answer

Two questions determine the choice: should TR7 see the content of the traffic, and should the connection between TR7 and the servers be encrypted? If content visibility is needed and the network between TR7 and the servers is secure, termination; if encryption up to the server is also needed together with visibility, bridging by turning on SSL Service on the Backend Service; if the private key cannot be placed on TR7, if the application will verify the client certificate or if there is no need to look at the content, passthrough with Protocol = TCP on an L7 TCP vService is selected. WAF, HTTP header actions and HSTS are used only on an HTTP vService, with termination or bridging.

Comparison

	Termination (offloading)	Bridging	Passthrough
Client ↔ TR7	Encrypted	Encrypted	Encrypted
TR7 ↔ Backend Service	Unencrypted	Encrypted (TLS established by TR7)	Encrypted (the client's TLS)
Does TR7 see the content	Yes	Yes	No
Where is the certificate	TR7	TR7 and server	Only the server
vService setting	HTTP: Protocol = Encrypted (HTTPS) group; L7 TCP: TCP + TLS; Certificate in both	Same as termination	L7 TCP: Protocol = TCP; no certificate is selected
Backend Service setting	SSL Service off	SSL Service on; the address is the TLS port of the server	SSL Service off; the address is the TLS port of the server
WAF, HTTP conditions and actions	Yes on an HTTP vService	Yes on an HTTP vService	No
TLS version and cipher rules	The SSL Security profile on the vService	vService profile + Backend SSL Security Profile on the Backend Service	Determined on the server
Differentiation by domain name	HTTP: Virtual Hosting and certificate selection by SNI ; L7 TCP (TCP + TLS): Dynamic Condition with SNI Received from Client	Same as termination	SSL SNI Info condition
TLS load on the server	None	Yes	Yes

Decision Rule

1. Are WAF, content conditions, Cache or header actions needed? Yes → termination or bridging, with an HTTP vService. No, and the traffic is not HTTP → termination or passthrough with L7 TCP.
2. Is the network between TR7 and the servers trusted? No, or regulations require encryption up to the server → bridging; yes → termination.
3. Can the private key not be placed on TR7, or must the application verify the client certificate itself? Yes → passthrough. If it is sufficient for TR7 to verify the client certificate, mTLS can also be used with termination (Can I authenticate clients with client certificates (mTLS)?).

Common Misconceptions

• "Passthrough is more secure." The traffic stays encrypted, but since TR7 cannot see the content, WAF and content inspection are not applied. If both encryption and inspection are needed, bridging is used.
• "In bridging, the server is verified automatically." Certificate Verification is None by default; for verification, Required and a Verification CA Profile are selected (Can I verify the backend certificate when connecting to the backend over HTTPS?).
• "When TCP + TLS is selected on L7 TCP, WAF also works." WAF exists only on an HTTP vService; on L7 TCP, even if TLS is decrypted, the content is not processed as HTTP.
• "TCP + TLS is passthrough." TCP + TLS terminates TLS on TR7; for passthrough, Protocol = TCP is selected.

How it is done in the documentation

• HTTP (L7) vService · Protocol
• L7 TCP vService · Protocol
• Backend Services · SSL Service
• SSL SNI Info · Scenario 1: SNI-Based Routing in SSL Passthrough

Related questions

• What is SSL offloading (termination), and how is it set up?
• What is SSL passthrough; when should I use passthrough instead of termination?
• What is SSL bridging; how do I also encrypt the traffic to the backend?