Is there any difference if you use TLS in your application for example in node or java(spring), and if you use normal HTTP in your application and then set up Nginx as a reverse proxy and configure your TLS certificate throw Nginx? What would be the benefits of using one instead of another?
1
-
This is sound question although maybe mis-placed but why -1?– KyslikApr 22, 2019 at 10:12
Add a comment
|
2 Answers
You will find people from both camps (terminating TLS as soon as possible vs terminating TLS in the application code) but it's not as serious as for example tabs vs spaces.
The benefit of terminating TLS by reverse proxy is that application developer does not have to implement TLS in the application itself - possibly introducing bugs. Another benefit mentioned by jdog is the CPU cost; which is negligible these days - unless you are running 100s of micro-services and it all adds up to a large chunk of money.
Personally I always go with reverse proxy terminating the TLS unless there is a specific requirement against it (security reasons). I also make sure that service behind reverse proxy listens on the localhost / local network only - is not accessible directly form the internet.
You may find wikipedia article about TLS termination useful.
There is no direct technical benefit. Some people argue that it takes some cpu load of the Web server. However there are equally articles that claim its only a very small percentage of cpu required to handle TLS.
One major benefit is that a http only caching server (for example Varnish) can be put between http server and tls termination without changing either Web server or public IP address. I have chosen this for my own Web hosting setup, as it is not always feasible to change DNS records en masse.
