Application Load Balancing (ELBv2) SSL Passes

Question

I am trying to configure an AWS application load balancer (compared to the classic load balancer) to distribute traffic to my EC2 web servers. For compliance reasons, I need end-to-end SSL / HTTPS encryption for my application.

It seems to me that the easiest way to provide traffic encryption between clients and web servers is to end the HTTPS connection on the web servers.

My first question is: is it possible to pass through HTTPS traffic through the AWS application load balancer to the web servers behind the load balancer in this way?

From what I have compiled from the AWS documentation, you can transfer traffic this way using the classic load balancer (through a TCP pass). However, the application load balancer looks as if it wants to end the HTTPS connection, and then do one of the following:

• send traffic to unencrypted web servers, which I cannot do for compliance reasons.
• create a new HTTPS connection to web servers that looks like an extra workload

My second question is: is the documentation understood correctly?

Answer 1

Terminating the SSL connection on web servers requires changing the load balancer from HTTPS to TCP. ALB does not support this, only the classic ELB. In addition, if you complete SSL on a web server, the load balancer will not be able to verify the request, since it will not be able to decrypt it, therefore it will not be able to perform all the necessary new routing functions that ALB supports.

If you really want to use ALB for the new features it provides, and you need end-to-end encryption, you will have to discontinue SSL in ALB, and also have an SSL certificate installed on web servers. A web server certificate can be something like a self-signed certificate, since only the ALB will see this certificate, not the client.

I assume you need end-to-end encryption for compliance reasons (PCI, HIPAA, etc.). Otherwise, you have no very good reason to overcome the difficulties with customization.