Document ID: RDWR-ALOS-V2900_AG1302
337
Chapter 14 – Offloading SSL Encryption and
Authentication
Secure Sockets Layer (SSL) is a security layer that can be added to various communication protocols
in order to serve four main purposes that contribute together to establishing a secure
communication channel.
This chapter discusses the Alteon SSL offloading capabilities which performs encryption, decryption,
and verification of Secure Sockets Layer (SSL) transmissions between clients and servers, relieving
the back-end servers of this task. This enables the back-end servers to maximize their performance
and efficiency, resulting in faster server response times and increased server capacity to handle
more concurrent users.
SSL encryption and authentication includes the following characteristics:
•
Authentication—Each communicating partner should be able to verify that the other is who it
claims to be and not an impostor.
•
Privacy—A third party should not be able to eavesdrop on a private communication.
•
Integrity—The protocol should or easily detect any tampering with the transmission.
•
Non-repudiation—Senders should not be able to claim that they did not send what the
receiver received.
The chapter includes the following sections:
•
SSL Offloading Implementation, page 337
•
•
Certificate Repository, page 338
•
Client Authentication Policies, page 343
•
Common SSL Offloading Service Use Cases, page 343
SSL Offloading Implementation
For Alteon to provide SSL offloading, you must configure, enable, and apply the following
components:
•
SSL Virtual Service—As discussed in
SSL Offloading Implementation, page 337
, you must
define an HTTPS or SSL virtual service and associate to it both an SSL server certificate, and an
SSL policy that governs the behavior of the SSL virtual service.
•
SSL Policy—As discussed in
, you must define an SSL policy and
associate it to the SSL virtual service. An SSL policy includes the definition of the ciphers that
enable SSL handshaking, as well as the type of traffic that is sent to the back-end servers.
An single SSL policy can be reused across multiple virtual services.
•
Certificate Repository—As discussed in
Certificate Repository, page 338
, you must supply a
server certificate that you associate with the SSL virtual service. The server certificate includes
the attributes needed to perform SSL handshaking and enable the decryption and encryption of
the traffic related to the virtual service.
You can associate only a single server certificate to a virtual service, but the same server
certificate can be used by multiple services.
You can associate multiple server certificates to a virtual service using Server Name Indication
(SNI). With SNI, the browser sends the requested hostname, enabling the server to recognize
which certificate to use before an SSL handshake and an actual HTTP request was made. The
same server certificate can also be used by multiple services.
