When TLS is terminated at the load balancer and backend re-encryption is not configured, requests are forwarded to targets in cleartext. Any entity with access to the internal network path between the load balancer and the targets can read or alter the traffic, compromising the confidentiality and integrity of the data.
Traffic to Backend Targets Is Forwarded Unencrypted
CCC.LB.TH09
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP11 | SSL/TLS Termination | The service can decrypt SSL or TLS encrypted traffic at the load balancer rather than at the backend servers, offloading the decryption task from the backend servers. |
| CCC.LB.CP25 | Backend Re-encryption | The service can re-encrypt traffic to backend targets after terminating TLS at the load balancer, so that data stays encrypted end to end. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.LB.CN12 | Encrypt Traffic to Backend Targets | Ensure that requests remain encrypted between the load balancer and its backend targets after TLS termination. |