7.6 What is SSL termination?

At the airport: Sealed envelopes are opened once, at the security gate, by trained staff with the right tools. The counters behind receive opened documents and get on with their work.

In the system: HTTPS traffic is encrypted (Chapter 3, section 3.8). SSL/TLS termination means the load balancer decrypts incoming HTTPS and forwards plain requests to the servers.

Why do it at the load balancer:

• One place for certificates. Renew and rotate them in one spot, not on 68 servers.
• L7 features need it. Path routing, cookie stickiness and header rules all need to read the decrypted request.
• Less work for app servers. The TLS handshakes are done at the edge.

The trade-off: traffic between the load balancer and servers is unencrypted unless you re-encrypt it. Inside a trusted private network, some teams accept that; many security standards and companies require end-to-end encryption, so the load balancer opens a new TLS connection to each server (TLS re-encryption, or TLS passthrough with an L4 load balancer that never decrypts at all, giving up L7 features).

Memory code: "Open the envelope once, at the gate." And decide whether to seal it again inside.

---