TLS termination proxy

A TLS termination proxy (or SSL termination proxy, or SSL offloading) is a proxy server that acts as an intermediary point between client and server applications. It is used to terminate and/or establish TLS (or DTLS) tunnels by decrypting and/or encrypting communications. This differs from TLS pass-through proxies, which forward encrypted (D)TLS traffic between clients and servers without terminating the tunnel.

Uses

TLS termination proxies can be used to:

secure plaintext communications over untrusted networks by tunnelling them in (D)TLS,

allow inspection of encrypted traffic by an intrusion detection system to detect and block malicious activities,

allow network surveillance and analysis of encrypted traffic,

enable otherwise unsupported integration with other applications that provide additional capabilities such as content filtering or Hardware security modules,

enable (D)TLS protocol versions, extensions, or capabilities (e.g., OCSP stapling, ALPN, DANE, CT validation, etc.) unsupported by client or server applications to enhance their compatibility and/or security,

work around buggy or insecure (D)TLS implementations in client or server applications to improve their compatibility and/or security,

provide additional certificate-based authentication unsupported by server and/or client applications or protocols,

provide an additional defense-in-depth layer for centralised control and consistent management of (D)TLS configuration and associated security policies, and

reduce the load on the main servers by offloading the cryptographic processing to another machine.

Types

TLS termination proxies can provide three connectivity patterns:

TLS Offloading: Terminates an inbound encrypted (D)TLS connection from a client and forwards communications over a plaintext connection to the server.

TLS Encryption: Accepts an inbound plaintext connection from a client and forwards communications over an encrypted (D)TLS connection to the server.

TLS Bridging: Terminates two encrypted (D)TLS connections to allow inspection and filtering of traffic. The proxy decrypts the inbound (D)TLS connection from the client and re-encrypts it using a separate (D)TLS connection to the server.

Combining a TLS Encrypting proxy in front of a client with a TLS Offloading proxy in front of a server can allow (D)TLS encryption and authentication for protocols and applications that do not otherwise support it, with the two proxies maintaining a secure (D)TLS tunnel over untrusted network segments between client and server.

A proxy used by clients as an intermediary gateway for all outbound connections is typically called a Forward proxy, while a proxy used by servers as an intermediary gateway for all inbound connections is typically called a Reverse proxy.