Subject: [TLS] https question

From: "Omirjan Batyrbaev" <[email-masked]>
Date: Tue, 21 Nov 2006 21:37:01 -0500

Hi,

How does non-decrypting load balancer or proxy would know where is the end
of the https request? Is content
length encrypted?

-Omirjan

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Martin Rex <[email-masked]>
Date: Thu, 23 Nov 2006 23:19:00 +0100 (MET)

Omirjan Batyrbaev wrote:
> of the https request? Is content length encrypted?

A non-decrypting load balancer does not know that.  I has also
no means to detect whether the protocol within the SSL/TLS tunnel
is really HTTP, or whether it is something else.

Only the record protocol is visible to such a load-balancer, but
nothing about the content once the encryption is started during
the initial SSL/TLS handshake.  

A curious observer might attempt traffic analyisis by the number
and size of the ssl records, but efficient client and browser
implementations might aggregate requests and replies of a
HTTP/1.1 persistent connection into few large SSL Records,
i.e 10 pipelined requests into a single SSL Record with
application data, and the Server could (in theory) do the
same with the replies.

Load balancing HTTPS without decrypting does have some limitations.
If the application is not state-less, then using the ssl session ID
for selecting the backend target is insufficient and will regularly
cause problems.  Routing the requests based on client IP addresses
and configurable client IP address ranges
(to support client-side proxy farms) is probably the most robust
approach.  If the majority of clients come through one single
client-side proxy, then this doesn't work, of course.

Having the backend (SSL/TLS terminating) Servers issue SSL session IDs
with backend-idenifying tags and a loadbalancer that can extract
and use these tags from the SSL session IDs might work, though,
but the existing SSL/TLS implementations may not currently offer an API
for the application to put such a tag into every SSL session ID
that they issue.

-Martin