Re: SSL w/ PCI best practices
Ali Abbas <[email protected]> Thu, 18 Feb 2010 20:29:21 +0100
| Newsgroups | gmane.comp.programming.load-balancing.general |
|---|---|
| Message-ID | <[email protected]> |
--===============0505348092== Content-Type: multipart/alternative; boundary=001517447a3c067d37047fe4fd66 --001517447a3c067d37047fe4fd66 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi David I have a question regarding the use of SSL while trying to maintain PCI > compliance. If a load balancer/SSL accelerator is handling SSL, what > advantage is that in terms of SSL offload if we must re-encrypt back to t= he > servers? This essentially limits the load balancer to URI inspection and > distributing traffic. There seems to be no advantage to handling Certs > (other than wildcard) or de-encryption. Forgive my ignorance but I=92m > looking for basic best practices in this situation. > > > Well it is a bit more complicated than this... it depends what kind of offloading you are doing, typically "termination" or "bridging" In "Termination", you do not re-encrypt the stream back to the server... th= e accelerator decrypts the stream and sends it in "clear text" to the server. In "Bridinging" (what you described earlier), the stream is decrypted - examined, then re-encrypted and sent over to the server. Also keep in mind, it is possible to only offload the symmetric operation o= f the public key while having the backend server process the asymmetric operation... that's just because RSA operations are heavy :-). -- Ali Abbas Blog: http://alouche.net Xing: https://www.xing.com/profile/Ali_Abbas5 --001517447a3c067d37047fe4fd66 Content-Type: text/html; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi David<br><br><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote= " style=3D"border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0= .8ex; padding-left: 1ex;"><div link=3D"blue" vlink=3D"#606420" lang=3D"EN-U= S"><div><p class=3D"MsoNormal"> <font face=3D"Arial" size=3D"2"><span style=3D"font-size: 10pt; font-family= : Arial;">I have a question regarding the use of SSL while trying to mainta= in PCI compliance. =A0If a load balancer/SSL accelerator is handling SSL, w= hat advantage is that in terms of SSL offload if we must re-encrypt back to the servers?=A0 This= essentially limits the load balancer to URI inspection and distributing tr= affic.=A0 There seems to be no advantage to handling Certs (other than wild= card) or de-encryption. =A0Forgive my ignorance but I=92m looking for basic best practices in this situation.</s= pan></font></p> <p class=3D"MsoNormal"><font face=3D"Arial" size=3D"2"><span style=3D"font-= size: 10pt; font-family: Arial;">=A0</span></font><br></p></div></div></blo= ckquote><div>Well it is a bit more complicated than this... it depends what= kind of offloading you are doing, typically "termination" or &qu= ot;bridging"<br> <br>In "Termination", you do not re-encrypt the stream back to th= e server... the accelerator decrypts the stream and sends it in "clear= text" to the server.<br><br>In "Bridinging" (what you descr= ibed earlier), the stream is decrypted - examined, then re-encrypted and se= nt over to the server.<br> <br>Also keep in mind, it is possible to only offload the symmetric operati= on of the public key while having the backend server process the asymmetric= operation... that's just because RSA operations are heavy :-).<br> <br>--<br>Ali Abbas<br>Blog: <a href=3D"http://alouche.net" target=3D"_blan= k">http://alouche.net</a><br>Xing: <a href=3D"https://www.xing.com/profile/= Ali_Abbas5" target=3D"_blank">https://www.xing.com/profile/Ali_Abbas5</a><b= r></div> </div> --001517447a3c067d37047fe4fd66-- --===============0505348092== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ lb-l mailing list [email protected] http://vegan.net/mailman/listinfo/lb-l Searchable Archive: http://vegan.net/lb/archive http://lbdigest.com Load Balancing Digest http://lbwiki.com Load Balancing Wiki --===============0505348092==--