TLS Termination

Problem

You have 100 backend servers. Do all of them need to independently handle external TLS connections and certificates? Sometimes you want one controlled edge to handle TLS first.

Solution — TLS Termination

Both an API gateway and an HTTPS-capable load balancer can terminate TLS: they complete the client's TLS connection and decrypt incoming requests before forwarding them to the backend.

Client
  ║ TLS
Load Balancer
  ↓
Backend

The backend connection can then use an appropriate internal security model, including another TLS connection if required.

Core idea: TLS termination centralizes where an incoming TLS connection ends.