"Configuring SSL with Your Load Balancer"

Serving your application over HTTPS is essential for security, user trust, and search engine rankings. When using a load balancer, SSL/TLS is typically handled at the load balancer level through a process called SSL termination. This approach simplifies certificate management and reduces the processing load on your backend servers.

This guide explains how to configure SSL on your Data Mammoth load balancer, including certificate options, setup steps, and best practices.

What Is SSL Termination?

SSL termination (also called TLS termination) means the load balancer handles the encryption and decryption of HTTPS traffic. Here is the flow:

User sends an HTTPS request to your domain.

Load balancer receives the encrypted request and decrypts it using the SSL certificate.

Load balancer forwards the unencrypted request to a backend server over the private network.

Backend server processes the request and sends the unencrypted response back to the load balancer.

Load balancer encrypts the response and sends it back to the user as an HTTPS response.

Benefits of SSL Termination at the Load Balancer

• Simplified certificate management. Install and manage certificates in one place (the load balancer) instead of on every backend server.
• Reduced backend server load. Encryption and decryption are CPU-intensive operations. Offloading them to the load balancer frees your backend servers to focus on serving your application.
• Easier certificate renewal. Update or renew certificates on the load balancer without touching any backend servers.
• Consistent HTTPS. All traffic to users is encrypted regardless of backend server configuration.

SSL Certificate Options

Option 1: Let's Encrypt (Free, Automated)

Let's Encrypt provides free, automated SSL certificates. If your Data Mammoth load balancer supports automatic Let's Encrypt integration:

Enter your domain name during HTTPS configuration.

The load balancer automatically requests and installs a Let's Encrypt certificate.

Certificate renewal is handled automatically (certificates renew before they expire).

This is the simplest option and is recommended for most users.

Option 2: Upload Your Own Certificate

If you have a certificate from a commercial certificate authority (CA) or need specific certificate features (wildcard, extended validation), you can upload it manually:

You will need:

• Certificate file (.crt or .pem) — Your SSL certificate.
• Private key file (.key) — The private key used to generate the certificate signing request.
• Certificate chain (.ca-bundle or intermediate certificate) — The chain of trust linking your certificate to the root CA.

Option 3: Wildcard Certificate

A wildcard certificate (e.g., *.yourdomain.com) covers all subdomains under a single domain. This is useful if your load balancer serves multiple subdomains:

• www.yourdomain.com
• api.yourdomain.com
• app.yourdomain.com

Upload the wildcard certificate to the load balancer, and all subdomains are covered.

Step 1 — Add Your Domain to DNS

Before configuring SSL, your domain must point to the load balancer:

Go to your DNS provider's management interface.

Create or update an A record for your domain pointing to the load balancer's IP address (e.g., 203.0.113.100).

Wait for DNS propagation (typically a few minutes to an hour).

Verify the DNS record by checking if your domain resolves to the load balancer's IP.

Step 2 — Configure HTTPS on the Load Balancer

Using Automatic Certificate (Let's Encrypt)

Navigate to Network > Load Balancer and click on your load balancer.

Go to Forwarding Rules or Listeners.

Click Add Rule or edit your existing HTTP rule.

Configure the HTTPS rule:

Click Save.

The load balancer will automatically obtain a certificate from Let's Encrypt. This may take a minute or two.

Using a Custom Certificate

Navigate to your load balancer's SSL Certificates or Certificates section.

Click Upload Certificate.

Paste or upload:

- Your certificate (.crt content). - Your private key (.key content). - The certificate chain (intermediate certificates).

Give the certificate a descriptive name (e.g., "yourdomain.com 2026").

Click Upload or Save.

Go to Forwarding Rules and create or edit your HTTPS rule:

Click Save.

Step 3 — Redirect HTTP to HTTPS

To ensure all traffic uses HTTPS, configure HTTP-to-HTTPS redirection:

Method 1: Load Balancer Redirect Rule

If your Data Mammoth load balancer supports redirect rules:

Create a forwarding rule for HTTP (port 80).

Set the action to Redirect to HTTPS instead of forwarding to a backend.

All HTTP requests will be automatically redirected to HTTPS.

Method 2: Backend Server Redirect

If the load balancer does not support redirect rules, configure your backend web servers to redirect HTTP to HTTPS. The web server detects unencrypted requests and sends a 301 redirect to the HTTPS URL.

Step 4 — Verify SSL Configuration

After setup, verify that HTTPS is working:

Browser test — Visit https://yourdomain.com and check for the lock icon in the browser address bar.

Certificate details — Click the lock icon to verify the certificate details (domain name, expiration date, issuing CA).

SSL testing tools — Use online SSL testing tools to check your configuration for security issues, protocol support, and certificate chain completeness.

Configuring TLS Settings

Minimum TLS Version

Configure the minimum TLS version your load balancer accepts. Recommended settings:

• TLS 1.2 — The minimum recommended version. Disabling TLS 1.0 and 1.1 protects against known vulnerabilities.
• TLS 1.3 — The latest version with improved security and performance. If your users all have modern browsers, you can set TLS 1.3 as the minimum.

A common configuration is to set the minimum to TLS 1.2, which supports both modern and slightly older clients.

Cipher Suites

Cipher suites determine which encryption algorithms are used for HTTPS connections. Most load balancers provide a default cipher suite configuration that is secure and compatible with the majority of clients. Unless you have specific compliance requirements, the default configuration is typically sufficient.

Backend Communication

HTTP Backend (Recommended for Most Cases)

With SSL termination, backend communication is unencrypted (HTTP). This is secure when:

• The load balancer and backend servers are in the same data center.
• Communication happens over a private network.
• No sensitive data needs protection in transit within your infrastructure.

HTTPS Backend (End-to-End Encryption)

For maximum security (or compliance requirements), you can configure the load balancer to forward traffic to backends using HTTPS:

This requires SSL certificates installed on each backend server as well. This is more complex to manage but provides end-to-end encryption.

Certificate Renewal

Automatic Renewal (Let's Encrypt)

Let's Encrypt certificates expire after 90 days. If your load balancer handles Let's Encrypt automatically, renewal happens seamlessly before expiration.

Manual Renewal

For custom certificates, monitor expiration dates and renew before they expire:

Obtain a renewed certificate from your CA.

Upload the new certificate to the load balancer.

Update the forwarding rule to use the new certificate.

Delete the old certificate after verifying the new one works.

Set a calendar reminder 30 days before expiration to begin the renewal process.

What to Do Next

• How to Set Up a Load Balancer — Complete load balancer setup guide.
• Configuring Health Checks — Ensure backend availability.
• Load Balancing Algorithms Explained — Optimize traffic distribution.
• Cloud Firewall Best Practices — Secure your load-balanced infrastructure.