Can the WAF see the content of HTTPS traffic; what is required for that?

Short answer

Yes, provided that TLS is terminated on TR7: the WAF inspects the request after the HTTP vService terminates TLS and before it sends the request to the Backend Service. For this, the vService must be of the HTTP type, an option from the Encrypted (HTTPS) group (HTTP/1.1, HTTP/2 or their variants with the HTTP/3 badge) must be selected in the Protocol field of the Frontend row, and at least one certificate must be selected in the Certificate field. The traffic to the Backend Service can be unencrypted (SSL offloading) or encrypted again by turning on SSL Service on the Backend Service (SSL bridging); in both cases the WAF sees the content. If the encrypted traffic is forwarded without being terminated on TR7 (SSL passthrough, L7 TCP vService), or even if an L7 TCP vService terminates TLS, the WAF cannot be used.

How Does It Work?

An HTTPS request comes encrypted with TLS; the content becomes readable only for the side that terminates the TLS session. On TR7, the HTTP vService terminates TLS on itself with a Protocol option in the Encrypted (HTTPS) group; the WAF inspects the request in its decrypted form after this point and before the target Backend Service is selected.

Setup	Where TLS is terminated	Traffic to the Backend Service	Does the WAF see the content
SSL offloading	TR7 (HTTP vService)	Unencrypted	Yes (What is SSL offloading (termination), and how is it set up?)
SSL bridging	TR7 (HTTP vService)	Encrypted again (SSL Service on)	Yes (What is SSL bridging; how do I also encrypt the traffic to the backend?)
SSL passthrough	Backend Service (L7 TCP vService, Protocol = TCP)	TR7 forwards it without decrypting it	No (What is SSL passthrough; when should I use passthrough instead of termination?)
TLS termination on L7 TCP	TR7 (L7 TCP vService, Protocol = TCP + TLS)	Unencrypted or encrypted again	No; there is no WAF on an L7 TCP vService (Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?)

There is no difference for the WAF between the HTTP/1.1, HTTP/2 and HTTP/3-badged options; the inspection is done on the parsed HTTP request after TLS is terminated.

What Is Required in TR7

1. The certificate must be defined on TR7 beforehand; if it is not, it is added or imported on the SSL/TLS Certificates screen.
2. In the Frontend row of the HTTP vService, an option from the Encrypted (HTTPS) group is selected for Protocol; with this selection the Certificate field appears and the certificate is selected. If more than one certificate is selected, they are matched according to the domain name the client requests with SNI.
3. The allowed TLS versions and cipher suites are determined with the SSL Security profile under Details.
4. WAF is turned on in the vService: How do I enable WAF protection on a vService?

The status of TLS termination is read in the TLS termination box on the Load Balancer Management screen of the vService; if no certificate is selected, the sentence "TLS is terminated but no certificate is selected" is written in the box and the "no certificate is selected" part is highlighted in amber.

Common Misconceptions

• "Selecting Encrypted (HTTPS) is enough." If the Certificate field is left empty, the form does not prevent the save, but that Frontend row listens as plain HTTP without terminating TLS; if a separate unencrypted row also stays open on port 80, unencrypted access from that address continues as well.
• "Going encrypted to the backend disables the WAF." In SSL bridging too, TLS is first terminated on TR7; the WAF inspects the request in the form decrypted on TR7, and then the request is sent to the Backend Service encrypted again.
• "When an L7 TCP vService terminates TLS, the WAF can be used." The WAF exists only on an HTTP vService; even if TLS is terminated on L7 TCP, the request is not parsed as HTTP.

How it is done in the documentation

• HTTP (L7) vService · Protocol
• HTTP (L7) vService · Certificate
• Backend Services · SSL Service
• WAF - WAAP · WAF on TR7

Related questions

• What is SSL offloading (termination), and how is it set up?
• What is SSL passthrough; when should I use passthrough instead of termination?
• Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?