Configuring Generic SSL Offloading

SSL Offloading portals extends the Application Offloading feature to support protocol independent SSL requests and forward them to the backend server. This feature is needed for customer client/server applications that use SSL for security.

The “Generic (SSL Offloading)” scheme is intended for deployments that require SSL offloading for custom SSL applications, i.e., non-HTTP(S). Layer 7 controls such as load balancing, Web Application Firewall, URL rewriting, authentication controls and access policies are not applicable when using this offloading method.

To configure generic SSL offloading:
1
Navigate to Portals > Portals and click the Offload Web Application button. The Add Portal screen opens. The screen contains the Offloading tab, used specifically for application offloading configuration.

2
On the Offloading tab, select Generic (SSL Offloading) as the Scheme.
3
Enter the IP address of the portal which will listen for incoming SSL requests in the Local IP Address field.
4
In the Local Port field, enter the port on which to listen for incoming SSL requests. This is often set to 443.
5
In the Application Server IP Address field, enter the IP Address of the backend server where SSL offloaded requests are to be proxied.
6
In the Application Server Port field, enter the port of the backend server where SSL offloaded requests are to be proxied. This is often set to 80 for internal HTTP communication.
7
Select the Enable SSL for Backend Connections check box to enable SSL encapsulation of all traffic destined for the backend application server.
8
Select the SSL Certificate to use for SSL connection to the portal. This list of certificates mirrors the list of sever certificates on the System > Certificates page.
9
On the General tab, enter a descriptive Portal Name name for this portal.
* 
NOTE: Other portal options such as Virtual Host and Logo are not available when using the Generic (SSL Offloading) scheme.
10
Click the Accept button to add this portal.

When completed, SSL Offloading portals are displayed in the list of portals on the Portals > Portals page. Note that the Virtual Host Settings column shows the Local IP:port --> Application Server IP:port as well as (SSL) if ‘Enable SSL for Backend Connections’ is enabled.

Verification and Considerations for Generic SSL Offloading

To view the SSL Offloading portal in action, point it to a backend web server and use a current Internet browser to view the SSL offloaded site, using the format <Local IP:port>

Generic (SSL Offloading) scheme is not meant for HTTP/HTTPS, and should not be used in deployments as such. Since there is no layer 7 analysis, issues such as insecure HTTP 30X redirects can occur and this is not recommended.