The service can decrypt SSL or TLS encrypted traffic at the load balancer rather than at the backend servers, offloading the decryption task from the backend servers.
SSL/TLS Termination
CCC.LB.CP11
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.LB.TH07 | TLS Certificates Are Expired or Invalid | Stale or untrusted certificates weaken encrypted-traffic protection. |
| CCC.LB.TH08 | Weak TLS Policy Permits Protocol Downgrade | The TLS policy on a listener may be configured to accept deprecated protocol versions or weak cipher suites. Clients can then be forced into a downgraded handshake and the session decrypted or modified by an entity on the transmission path, compromising the confidentiality and integrity of the data in transit. |
| CCC.LB.TH09 | Traffic to Backend Targets Is Forwarded Unencrypted | When TLS is terminated at the load balancer and backend re-encryption is not configured, requests are forwarded to targets in cleartext. Any entity with access to the internal network path between the load balancer and the targets can read or alter the traffic, compromising the confidentiality and integrity of the data. |