TL;DR
SSL offloading delegates the computationally intensive work of encrypting and decrypting web traffic to a dedicated server or load balancer, freeing up primary servers to focus on delivering content. It comes in two forms — SSL termination (traffic is decrypted and forwarded unencrypted) and SSL bridging (traffic is decrypted then re-encrypted before forwarding). High-traffic sites stand to gain the most from this approach through improved performance, better traffic regulation, and an added layer of security screening.
What SSL offloading means for server performance
Secure Sockets Layer (SSL) offloading involves using a dedicated server for all SSL encryption and decryption. Dealing with traffic in this way frees up your main server to handle all other tasks associated with serving your visitors.
What is SSL offloading?
More than 90 percent of internet traffic is encrypted. That scrambling (and unscrambling) of critical data requires processing. An SSL load balancer handles this task for you.
During SSL handshakes, a device and a server communicate via encryption. Messages come in scrambled, they must be decoded, and then the response is scrambled again.
An SSL load balancer handles these tasks. That could mean that your site loads faster, works better, or both.
Two main types of SSL offloading exist:
| Type | How It Works | Post-Decryption Behavior |
|---|---|---|
| SSL termination | Load balancer sits on the edge and intercepts all incoming traffic | Traffic is forwarded to the server via non-encrypted means |
| SSL bridging | Load balancer sits on the edge and intercepts all incoming traffic | Traffic is re-encrypted before being passed to the server |
Should you use SSL offloading?
Few organizations want to make their computing systems yet more complex. But there are plenty of reasons to consider SSL offloading.
Known advantages include:
- Server preservation. When your main servers aren't forced to deal with encryption and decryption, they are freed up to serve your visitors.
- Traffic regulation. Some load-balancing systems allow you to scale back traffic as needed to avoid a crash.
- Added safety. Your extra server could catch malicious traffic the main server might miss or overlook.
When does SSL offloading make sense for your site?
In general, if you have a very large site that gets plenty of traffic, SSL offloading could make a lot of sense. Google, with its estimated 93 billion monthly visitors, likely relies on load balancing.
But if your site is very small and you can handle the traffic you have, adding complexity may not be useful for you.
How do you set up SSL offloading?
If you do need SSL offloading, you'll route SSL requests to your designated device, and you'll tell it to forward that traffic to the proper server. You'll need a valid SSL certificate, of course.
Looking for more ways to secure your traffic? We can help. Contact us at Okta for personalized recommendations.
Frequently asked questions
What is the difference between SSL termination and SSL bridging?
SSL termination decrypts incoming traffic at the load balancer and forwards it to the backend server without re-encrypting it. SSL bridging also decrypts traffic at the load balancer, but then re-encrypts it before passing it along to the server, maintaining end-to-end encryption throughout the journey.
Does SSL offloading make my website less secure?
It depends on the method used. SSL termination means traffic travels unencrypted between the load balancer and the backend server, which can introduce risk on internal networks. SSL bridging addresses this by re-encrypting traffic before forwarding it, preserving a higher level of security throughout the connection.
What kind of sites benefit most from SSL offloading?
Sites with very high traffic volumes benefit the most, as the computational cost of encrypting and decrypting data at scale can strain primary servers. Smaller sites with manageable traffic levels may find that the added complexity of SSL offloading outweighs its benefits.
What do I need to implement SSL offloading?
You need a dedicated device or server to act as your SSL load balancer, configuration to route SSL requests to that device, and a valid SSL certificate. The load balancer is then set up to forward decrypted (or re-encrypted) traffic to the appropriate backend server.
Can SSL offloading help with traffic management beyond encryption?
Yes. Some load-balancing systems that handle SSL offloading also include traffic regulation features, allowing you to scale back incoming traffic as needed to prevent server overload or crashes.
Can an SSL load balancer improve security beyond just handling encryption?
Yes. Because the SSL load balancer sits at the edge and processes all incoming traffic, it has the opportunity to inspect and catch malicious traffic that might otherwise slip past or be overlooked by the main server.
References
HTTPS Encryption Traffic on the Internet Has Exceeded 90 Percent. (November 2019). InfoTech News.
The World's Top 50 Websites. (January 2021). Visual Capitalist.
