Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Is there a difference between TCP + TLS termination on L7 TCP and termination on an HTTP vService?
Short answer
The TLS layer is the same: the certificate and the version, cipher and mTLS settings in the TLS Security Profile are applied in the same way in both types. The difference is after TLS is decrypted: an HTTP vService processes the request as HTTP (WAF, Cache, header actions, HSTS, SNI/Host Validation, HTTP → HTTPS, HTTP/2 and HTTP/3); an L7 TCP vService, on the other hand, forwards the decrypted traffic as a byte stream and uses only connection-level conditions.
Comparison
| HTTP vService | L7 TCP vService (TCP + TLS) | |
|---|---|---|
| Encrypted Protocol options | HTTP/1.1 and HTTP/2 (with the HTTP/3 badge) under Encrypted (HTTPS); also Redirect HTTP → HTTPS | TCP + TLS under Encrypted (TLS) |
| Certificate, version, cipher, mTLS | Same | Same |
| Processing after TLS | HTTP is parsed: WAF, Cache, Compression, X-Forwarded-For, header and cookie actions, Host and path conditions | Byte stream; connection-level conditions (Source IP, Destination Port, SSL Version, SSL Cipher, etc.) |
| HSTS and SNI/Host Validation in the profile | Applied | Not applied |
| HTTP → HTTPS redirect | Yes | No |
| Virtual Hosting | Yes | No |
| Blocking action | Block | TCP Connection Management (Reject / Silent Drop) |
Which One When?
- HTTP vService for web applications and APIs: content visibility and HTTP features are required (Should I use an HTTP vService or an L7 TCP vService for my HTTPS site?).
- For non-HTTP TLS protocols (e.g. LDAPS, SMTPS, database TLS connections), Protocol = TCP + TLS on an L7 TCP vService: TLS terminates on TR7, and the application protocol is forwarded without being decoded.
Common Misconceptions
- "When TCP + TLS is selected, WAF works." WAF and HTTP actions depend on the vService type; they exist only on an HTTP vService.
- "I add HSTS on L7 TCP." HSTS is an HTTP response header; even if it is on in the profile, it is not added on an L7 TCP vService.
- "With TCP + TLS, I route based on SNI with the SSL SNI Info condition." The SSL SNI Info condition matches only on connections where TLS is not decrypted on TR7 (Protocol = TCP); with TCP + TLS, routing based on SNI is done with Dynamic Condition through the SNI Received from Client variable, and the distinction is also made with SSL Version, SSL Cipher or address conditions (Can I route or block traffic based on TLS version or cipher?).
- "The TLS settings are different in the two types." The certificate and TLS Security Profile settings are applied in the same way; only the HTTP-specific profile fields (HSTS, SNI/Host Validation) have no effect on an L7 TCP vService.
How it is done in the documentation
