Skip to main content
HTTPS / TLSlesson 4 of 4 · 2 min read

TLS Termination in Real Architectures

Where TLS ends

Somewhere in your architecture TLS has to end, and choosing where is a real design decision.

End it at the edge, as most people do. Your load balancer holds the certificate, decrypts, and forwards plain HTTP to your application servers.

You get one place to manage certificates and ciphers, the cryptography concentrated in one tier, and the ability to route on headers. What you paid for that convenience is an assumption: that the network behind your balancer is trustworthy.

The assumption that broke

Watch that assumption take a public beating. In 2013 leaked documents showed an intelligence agency tapping the private fibre between one company's data centres, where traffic ran unencrypted precisely because it was internal.

Adopt the response the industry landed on: treat your own network as hostile too. In practice that means encrypting again from your balancer to your backends. Or going further with mutual TLS, where both sides present certificates so a service can prove which service is calling it.

Expect distributing those certificates yourself to be painful. That is a large part of why service meshes exist. They put a proxy next to each of your services and transparently upgrade the traffic between them, rotating keys automatically.

Keep two edge details ready. A strict transport header tells browsers never to use plain HTTP for your domain again. That closes the window where a first unencrypted request gets intercepted before your redirect fires, and a preload list bakes it into browsers before anyone has even visited.

Drop the performance objection, because it died long ago. When one large mail provider went encryption-only in 2010, it cost them under 1 percent of their processors and under 2 percent of network overhead, on 2010 hardware. If TLS shows up in your profiles today, something else is wrong.

the shape of it
UserLoad balancerTLS ends hereApp server AApp server BHTTPSHTTP or mTLSHTTP or mTLS
step 1 of 2
Terminating at the load balancer centralizes certificates; whether traffic behind it gets re-encrypted is a trust decision about your own network.

Worked example

In October 2013 the Washington Post published an NSA slide describing the MUSCULAR program, complete with a hand-drawn smiley face next to the note "SSL added and removed here," marking the exact point where Google traffic crossed between data centers in the clear. Google engineers responded publicly and angrily, and the company accelerated a program already underway to encrypt all inter-datacenter links, finishing within months. It later published details of ALTS, its internal mutual authentication protocol, under which every RPC between internal services is authenticated and encrypted by default. That one slide did more for internal-traffic encryption than a decade of conference talks: within two years, encrypting east-west traffic went from paranoia to a checklist item, and today a service mesh gives a ten-person startup the posture Google had to build by hand.

HTTPS / TLS: wrapping up

In the real world

  • 01Let's Encrypt has issued free 90-day certificates over the ACME protocol since 2015 and now secures hundreds of millions of sites; the short lifetime deliberately forces renewal automation.
  • 02When Google made Gmail HTTPS-only in 2010, Adam Langley reported TLS cost under 1 percent of CPU and under 2 percent of network overhead, ending the performance excuse for good.
  • 03Chrome 68 (July 2018) started labeling every plain HTTP page "Not secure," and Google had already made HTTPS a search ranking signal in 2014.
  • 04Cloudflare enables TLS 1.3 by default across its edge network and restricts 0-RTT early data to requests that are safe to replay, like parameter-free GETs.
  • 05Istio and Linkerd give microservices mutual TLS by injecting sidecar proxies that handle certificate issuance and rotation, so application code never touches a key.

Questions people ask

Is SSL different from TLS?

SSL is the predecessor protocol, and every version of it is broken and disabled; SSL 3.0 died for good after the POODLE attack in 2014. Everything in production today is TLS 1.2 or 1.3. The phrase "SSL certificate" survives purely as naming inertia; the certificate itself is the same X.509 document either way.

Does the padlock mean a site is safe?

No. It means the connection to that site is encrypted and the certificate matches the domain. Phishing sites obtain valid certificates in minutes, so a padlock on a lookalike domain proves only that your traffic to the scammer is private. TLS authenticates the channel, not the character of the business behind it.

Is it acceptable to terminate TLS at the load balancer and run plain HTTP inside?

It's common and defensible for small systems inside a private VPC, and it was the default answer for years. Regulated environments and zero trust architectures now re-encrypt to backends or run mTLS between services, usually via a service mesh. The interview-safe answer names the tradeoff: operational simplicity against trusting your internal network.

Quick review

TLS 1.3 handshake: ClientHello (cipher suites) → ServerHello + Certificate → Key exchange (ECDH) → Finished. 1 round-trip
Asymmetric crypto (RSA/ECDH) used only for key exchange. Symmetric (AES-256-GCM) for actual data. Much faster
Certificate chain:
leaf cert → intermediate CA → root CA. Browser verifies against built-in root store
Certificate pinning:
mobile app hardcodes expected cert fingerprint. Prevents MITM even with rogue CA
HSTS (HTTP Strict Transport Security):
browser always uses HTTPS for domain. Prevents SSL stripping attacks
mTLS (mutual TLS):
both client and server present certificates. Used for service-to-service auth in microservices
the trade-off

TLS adds 1 to 3ms handshake latency. Session resumption and 0-RTT (TLS 1.3) minimize this for repeat connections.

in the room

Always. Every production service should use TLS. TLS termination at load balancer, then plain HTTP internally is acceptable.