Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Should I use an HTTP vService or an L7 TCP vService for my HTTPS site?
Short answer
An HTTP vService is used for HTTPS websites: TLS is terminated on TR7, the request is read as HTTP, and WAF, AGS, Cache, Compression, X-Forwarded-For, Actions and routing by path can be used; if needed, the traffic is sent to the Backend Service re-encrypted with SSL Service. L7 TCP is selected only if the TLS session must reach the Backend Service untouched (SSL passthrough): TCP is selected as the Protocol in the frontend row, and SSL Service stays off on the Backend Service. In this case, none of the HTTP-specific features can be used.
How Does It Work?
- HTTP vService (TLS terminates on TR7): The certificate is uploaded to TR7, and a protocol (HTTP/1.1 or HTTP/2) from the Encrypted (HTTPS) group of the Protocol field is selected in the frontend row. TLS is decrypted on TR7, and the request is read and processed. It is forwarded to the Backend Service unencrypted or, if SSL Service is on in the Backend Service, re-encrypted; thus TR7 can see the content while the traffic stays encrypted end to end.
- L7 TCP, Protocol: TCP (SSL passthrough): TCP in the Unencrypted group of the Protocol field is selected in the frontend row; TR7 does not open TLS and forwards the encrypted stream as it is to the Backend Service. Since the SNI in the TLS handshake can be read without decryption, routing by domain name can be done with the SSL SNI Info condition; the content of the request is not seen.
- L7 TCP, Protocol: TCP + TLS: TLS is terminated on TR7, but the stream is not parsed as HTTP; HTTP-specific features cannot be used in this case either.
Passthrough Settings with L7 TCP
In passthrough, TLS is established between the client and the Backend Service; TR7 must not interfere with the encryption at two points:
| Where | Field | Value | Why |
|---|---|---|---|
| vService form | Type | L7 TCP | Passthrough is done at the connection level. |
| Frontend row | Protocol | TCP (Unencrypted group). In the API, the ssl field of the frontend row stays empty (None). | If TCP + TLS is selected, TLS is terminated on TR7; it is not passthrough. The Certificate field appears only while there is a row with TCP + TLS selected. |
| Backend Service form | SSL Service | Off (default) | While SSL Service is on, TR7 opens its own TLS session to the Backend Service; the client's encrypted stream goes inside a second TLS layer, and the TLS handshake on the server fails. |
| Backend Service form | Address | The port on which the server listens for TLS (e.g. 192.0.2.20:443) | Since the certificate and TLS are on the server, the connection is made to the TLS port. |
On the Backend Service side: The certificate and the private key are on the server, and the server terminates TLS itself. The server must present the certificate of the domain name the clients connect to; TR7 does not touch the certificate. Step-by-step configuration: What is SSL passthrough; when should I use passthrough instead of termination?
Comparison
| HTTP vService | L7 TCP (passthrough) | |
|---|---|---|
| Where the certificate is | On TR7 (SSL/TLS Certificates) | On the Backend Service |
| WAF, AGS | ✓ | ✗ |
| Cache, Compression | ✓ | ✗ |
| X-Forwarded-For, Trusted Proxy | ✓ | ✗ |
| Routing criteria (Conditional Backend Services) | Path, header, cookie, SNI, source IP… | Source IP, destination port, SNI (SSL SNI Info condition) |
| HTTP/2, HTTP/3 | Selected on TR7 with the frontend Protocol | There is no setting for it on TR7; HTTP/2 is negotiated between the client and the server |
| HTTP → HTTPS redirect | ✓ (Protocol: HTTP → HTTPS) | ✗ |
| Persistence | New cookie, Current cookie, Hash, SAM | Hash |
| Encrypted forwarding to the Backend Service | ✓ (re-encryption with SSL Service) | ✓ (the client's TLS session) |
| Client certificate verification (mTLS) | On TR7 (TLS Security Profiles) | On the Backend Service |
| Request records | HTTP Logs (each request) | TCP Logs (each connection) |
When to Use L7 TCP?
| Your situation | Type |
|---|---|
| The certificate and the private key can be placed on TR7 | HTTP |
| Due to corporate policy, the private key must stay only on the server | L7 TCP (passthrough) |
| The Backend Service has to verify the client certificate in its own TLS session | L7 TCP (passthrough) |
| The traffic is not HTTPS but another protocol over TLS | L7 TCP |
Common Misconceptions
- "End-to-end encryption requires L7 TCP." After terminating TLS, the HTTP vService re-encrypts the traffic to the Backend Service with SSL Service; the traffic is still encrypted end to end (What is SSL bridging; how do I also encrypt the traffic to the backend?).
- "In passthrough, the SSL Service option of the Backend Service must also be turned on." SSL Service means that TR7 opens its own TLS session to the Backend Service; in passthrough, it stays off.
- "I can also do routing by path with L7 TCP." L7 TCP does not read the request as HTTP; it routes by source IP, port, SNI and TLS information.
- "Passthrough is required for the client certificate (mTLS)." TR7 can verify the client certificate itself with TLS Security Profiles; passthrough is needed only if the verification must be done on the server.
How it is done in the documentation
Related questions
- What is SSL passthrough; when should I use passthrough instead of termination?
- What is SSL bridging; how do I also encrypt the traffic to the backend?
- Is there a difference between TCP + TLS termination on L7 TCP and termination on an HTTP vService?
- Which vService type should I choose for my application?
