SSL PassThrough or Termination or Bridging

When you’re setting up the infrastructure for a new backend application, one key decision is how to handle encrypted traffic — basically, how and where to decrypt the secure data sent by users.

Think of it like this: You’re getting a sealed letter (encrypted data). Do you open it at the post office (the load balancer) or do you send it sealed to the recipient’s house (the server)?

For a fintech or healthcare app, where you’re dealing with really sensitive data, you might prefer not to open the letter at the post office. Instead, send it sealed directly to the house, where it’s opened in a more private setting. This approach, known as SSL Pass Through, is like a direct line — more secure because fewer hands touch the letter, reducing the risk of someone peeking inside.

On the other hand, for an e-commerce site, you’re handling tons of mail every day — user requests, personalised content, etc. Here, opening letters at the post office can speed things up. You quickly sort them out — send this to billing, that to customer service. This is SSL Termination. The post office (load balancer) does more work, but it streamlines the process, making things faster and more efficient for the servers handling specific tasks.

Now, imagine a scenario where you open the letter at the post office (the load balancer), read it, and then put it into a new envelope before sending it to the house (the server). This is SSL Bridging. Here, the post office briefly checks the content for any special instructions or security concerns, then reseals it, ensuring it’s still secure when it reaches the house. This approach is a bit of a middle ground — it allows for some inspection and routing at the load balancer level, while still keeping the data secure for its final destination.

So, SSL Pass Through keeps things super secure by limiting access to data, ideal for sensitive info. SSL Termination, meanwhile, helps manage heavy traffic efficiently, perfect for sites with lots of user interaction. And SSL Bridging? It offers a balance — allowing for some inspection and smart routing, while still maintaining a high level of security. It’s all about choosing the right approach for your app’s needs.

Alright, now that we understand the different SSL configurations, let’s talk about how to set these up in AWS, specifically for applications running on AWS ECS (Elastic Container Service). We’ll go into the details in the next part, but here’s a brief overview:

1. SSL Pass-Through: You’ll use an AWS Network Load Balancer (NLB) for this. The NLB will pass the encrypted traffic directly to your ECS service without decrypting it. Your containers in ECS will handle the decryption.
2. SSL Termination: Here, an Application Load Balancer (ALB) is your go-to. The ALB will decrypt incoming SSL traffic and then forward it as plain HTTP to your ECS containers. This offloads the decryption process from your ECS service.
3. SSL Bridging: This is a bit more complex. You’ll still use an ALB, but in this case, it decrypts the traffic, inspects or routes it as needed, and then re-encrypts it before sending it to your ECS service. Your ECS containers will handle the decryption of this re-encrypted traffic.

In the next part, we’ll delve into the specifics of configuring these setups, including setting up the load balancers and the ECS tasks to handle the traffic according to your chosen SSL strategy. Stay tuned!