1

I don't have the faintest clue on how a software or hardware load balancer works. I guess the hardware load balancer is basically a switch and based on some algorithm decides which node to switch to for a incoming request. On the software load balancer front, I guess the software picks up a node and uses a reverse proxy connection to it. In such a scenario, 2-way SSL wont work as the load balancer cannot have the client's private key.

Again, I don't how a software load balancer works but as my application would need a load balancer and as the application uses 2-way SSL connection, I wanted to know how does a software load balancer take care of a 2-way SSL connection.

3
  • Could you elaborate on what you mean by 2-way SSL? There are a couple of different configurations for load balancers where in one case they terminate the SSL request and forward on a new request in a sense while in the other it is merely forwarding the request I believe.
    – JB King
    Feb 13, 2009 at 19:09
  • In a 2-way SSL both client and server exchange their certificates and a 128 bit key is shared. This key is used to encrypt the data in the between the client and the server. Reverse proxy in such a scenario will fail as the LB wont have clients private key.
    – kittugadu
    Feb 14, 2009 at 4:04
  • My idea of a software load balancer was at a very high level and I thought the a webserver would actually reverse proxy the HTTP requests. As I have found out that load balancer use switching at OSI layers and that there is no problem with 2-way SSL as the data packets are switched to the nodes
    – kittugadu
    Feb 16, 2009 at 9:19

3 Answers 3

2

No, SSL works with a load balancer. They typically work at the TCP level, so the clients connect to the LB IP address, but it NATs the connections on to the real servers. The connection persists to the same real server for its lifetime, but if the same client makes another one, it can (and typically would) go to a different server.

For HTTPS this works fine, except that if you have a web server which supports SSL session caching, then the SSL session cache will be lost if the client comes back to a different server. In practice this is not a big problem. Of course HTTP keep-alive sessions aren't affected because they are a single TCP connection so they stay on the same realserver.

2

Generally speaking, a software load balancer will note that there is a new incoming connection request, assess the workload on the machines available, and allocate the new request to the most appropriate machine. When there is a session-based service, that connection will last for the duration of the session; rebalancing would only occur if a server went down, and would probably establish new connections in a newly balanced configuration.

So, as Jon implied, the SSL session would be established with a server, and would continue with that server until the session terminates.

If you want to route connections more dynamically, then it may be that the SSL session has to be terminated (decrypted) in front of the software that dynamically sends requests to different servers.

All these are possible - they are not necessarily efficient or implemented.

0

A software load balancer will distribute sessions evenly across multiple servers.

So, if a user hits your load balancer, it will send him to a specific server and that server will negotiate the SSL. The user will continually talk to this server until his session expires. At that point, he will hit the load balancer again.

1
  • To be honest, I just know a basic overview of how this works.I never got into the nitty gritty. On our hardware balancers, it checks the server for a specific file (lb.html). If it can hit the file, the server is deemed alive. The user is redirected via IP address.I am assuming software is similar
    – jgallant
    Feb 13, 2009 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.