Welcome to the Knowledge Portal Video series.
In the last lecture we looked into how we can have a self-signed certificate for the Nginx based web
server.
Today we are going to talk about SSL termination.
Now, if we look at a scenario where you have a reverse proxy and there is a upstream which is application
server.
Now generally we if we talk about application server like Tomcat or maybe PHP, FPM, they are not very
good at.
Handling the SSL based connections, it will actually slow them down.
And this is one of the reasons why in the enterprise as well, there is a SSL termination which is done
at the reverse proxy itself.
Now in this example, this is a example.com domain where nginx is acting as a reverse proxy and there
is one application server and we have a SSL based website which is Https.
So generally web browser calls https example.com.
And there is a SSL connection which is established.
However, the SSL termination happens at the reverse proxy itself.
The SSL does not.
Interfere between the communication of example.com, reverse proxy and the application server.
So the communication that is taking place between the reverse proxy and application server is still
based on plain text.
Only the communication between a web browser and the reverse proxy is happening with the SSL.
And this is one of the reasons why it is called SSL termination at the reverse proxy.
And this is the ideal configuration.
Now, many times this is not a very viable solution.
Specifically, if your application server is residing in an environment which is not fully trusted.
So in this case, what happens is there are two SSL connection that happens.
The first is between a client and the reverse proxy.
So here the termination happens as the reverse proxy site.
However, the communication between reverse proxy and the application server again happens with a second
SSL based connection.
So essentially what is happening over here is there are two SSL connections, one between client and
reverse proxy, and the second is between reverse proxy and the application server.
Now, generally, if we talk about enterprise, they will try to avoid the second SSL based.
A connection because it actually slows down the overall performance.
Now, whenever you have.
Your applications server on the cloud, which you really don't trust.
Then having a SSL termination to the upstream is a mandatory requirement specifically if you are following
a PCI based compliance.
Now I have a website called as Vodacom, which is basically running on a reverse proxy, so I'll show
you on how exactly it works.
Now I'm connected to my production server.
So if I do a vim on zilveren underscore SSL dot conf.
So essentially this is my configuration file.
Now the server name is zalora.com.
It's listening on 443.
These are my certificates.
So this is my certificate and this is my key.
It is doing a proxy pass to the upstream server over here and this is essentially what is happening.
So this is my Nginx acting as a reverse proxy.
So this configuration is essentially stored in the nginx reverse proxy.
So Nginx will itself terminate the SSL on on the same server.
However, as far as proxy pass is concerned, it is still using the Http based connection.
Now if I open https say Vodacom.
Essentially the website is loading and the SSL is getting terminated at the reverse proxy itself.
Now, if you want to know more about this particular connection, let's go to more information.
Let's view the certificate now in the common name.
It is saying that this certificate is issued.
This issued by Comodo and issued to Vodacom.
If we go into the details here, there are multiple intermediary software.
So if we look first hierarchy starts with the address external route, followed by Comodo, RSA.
And there is one more over here, and this is one of the reasons why the bundle was given by the Comodo
itself, because traditionally a web browser will not trust these certificates.
It will only trust the root certificate.
And this is one of the reasons why the CA bundle was essentially introduced.
Now, one more important thing to know is if I just go to https.com by default, the browser will only
show secure content.
Now I have not configured my WordPress.
To work on full SSL based connection.
So essentially I need to unblock it.
I'll say disabled protection on this page.
And essentially now it will show the whole page by itself because there are many requests which are
still going with the Http connection and browser.
When we open Https, it will not load the Http based requests.
So this is it about the SSL termination.
The only thing I wanted to show here is that if you are having a reverse proxy environment, then you
need to write your SSL termination at the reverse proxy based Nginx.conf.
So this is it.
I hope this has been informative for you and I'd like to thank you for viewing.