101 · Question #212
Which is an advantage of terminating SSL communication at the BIG-IP rather than the ultimate web server.
The correct answer is A. Terminating SSL at the BIG-IP can eliminate SSL processing at the web servers.. Terminating SSL at the BIG-IP offloads CPU-intensive cryptographic processing from web servers, freeing server resources for application workloads.
Question
Which is an advantage of terminating SSL communication at the BIG-IP rather than the ultimate web server.
Options
- ATerminating SSL at the BIG-IP can eliminate SSL processing at the web servers.
- BTerminating SSL at the BIG-IP eliminates all unencrypted traffic from the nternal.network.
- CTerminating SSL at the BIG-IP eliminates all unencrypted traffic from the .nternal.network.
- DTerminating SSL at the BIG-IP eliminates the need to purchase SSL certificates from a certificate
- ETerminating SSL at the BIG-IP eliminates the need to use SSL acceleration hardware anywhere
How the community answered
(26 responses)- A88% (23)
- C4% (1)
- D8% (2)
Why each option
Terminating SSL at the BIG-IP offloads CPU-intensive cryptographic processing from web servers, freeing server resources for application workloads.
SSL/TLS encryption and decryption are computationally expensive operations. By terminating SSL at the BIG-IP, web servers receive plain HTTP connections and are relieved of all cryptographic overhead, allowing them to dedicate their CPU cycles to serving application content and improving overall throughput and scalability.
Terminating SSL at the BIG-IP actually introduces unencrypted traffic on the internal network between the BIG-IP and the web servers unless a ServerSSL profile is used to re-encrypt that leg.
Same technical flaw as option B - SSL offload without re-encryption means traffic between the BIG-IP and pool members travels in cleartext internally.
An SSL certificate is still required and must be installed on the BIG-IP itself to present to connecting clients; offloading SSL does not eliminate the certificate requirement.
SSL acceleration hardware may still be needed or beneficial at the BIG-IP tier itself, especially under high connection volumes, so this advantage is not eliminated.
Concept tested: F5 BIG-IP SSL offloading performance advantage
Source: https://support.f5.com/csp/article/K14783
Topics
Community Discussion
No community discussion yet for this question.