Transport Layer Security (TLS) encrypts communications between the client and the server to protect against potential hackers and man-in-the-middle attacks. "TLS offloading" is the process of using a Hardware Security Module (HSM) to perform the TLS encryption and decryption instead of letting / trusting web server to do so, which significantly reduces the risk of key compromise. TLS is sometimes incorrectly referred to as SSL, which is a deprecated protocol that performed the same function as TLS.
"TLS offloading" relieves a web server of the processing burden of encrypting and decrypting traffic. Offloading TLS to a separate server helps with the following tasks:
Inspecting client requests for dangerous content that could compromise the security of web servers
Validating the identity of clients before any access is allowed to web resources
Obfuscating URLs and fixing issues related to publishing applications with hard-coded elements
Preventing the transfer of specific types of content based on patterns such as file extensions
Redirecting traffic based on content type, such as sending all image requests to a server that's optimized for serving images
Caching web content on the load balancer, thus removing the need to re-request frequently accessed content from the web server
Re-encrypting traffic going to the servers for additional security
Test if the Docker container is performing TLS offloading as expected by using the following command:
curl -k https://localhost:2080
Show more
If the nginx-tls-offload container is working as expected, you should see the following response:
Welcome to openssl engine & grep11 service!
If you see this page, the openssl engine and grep11 service were successfully installed and working.
Show more
You have successfully offloaded your TLS workloads on an NGINX load balancer using keys managed by IBM Cloud Hyper Protect Crypto Services.
Step 3. Troubleshooting
If anything goes wrong, do the following:
Stop the Docker container: docker rm -f nginx-tlsoffload-container
Delete the Docker container: docker rmi nginx-tls-offload:latest
Repeat Step 2 to rebuild the Docker image and run the Docker container.
Summary
Offloading TLS to a load balancer such as NGINX allows for a single, centralized point of control and management. Certificates and private keys only need to be managed in one place rather than on multiple servers. Policies can be applied and managed in one place. This greatly simplifies the administration overhead and also allows for separation of the security role from the application owner role.
You can try the technique described here with other load balancers, web application firewalls, caching servers, etc. You can also create machine learning algorithms that can benefit from inspecting the content that is dropped to create better algorithms that learn-as-you-go to ensure the safety of your web-applications environment.
Acknowledgements
We would like to thank Luis Carlos Silva for his contributions to the original tutorial.
About cookies on this siteOur websites require some cookies to function properly (required). In addition, other cookies may be used with your consent to analyze site usage, improve the user experience and for advertising.For more information, please review your cookie preferences options. By visiting our website, you agree to our processing of information as described in IBM’sprivacy statement. To provide a smooth navigation, your cookie preferences will be shared across the IBM web domains listed here.