TLS Termination (SSL termination)

TLS termination describes where a client's encrypted connection ends. The component that terminates TLS holds the certificate and private key, completes the handshake, and from then on sees plaintext requests. Common termination points are a CDN edge, a cloud load balancer, a Kubernetes ingress controller, a reverse proxy such as nginx, or the application server itself. Behind that point traffic may travel in plaintext or be re-encrypted on a new TLS connection to the backend; alternatively, a proxy can skip termination and pass the encrypted stream through to the backend (TLS passthrough).

Why it matters

The termination point defines your security boundary. The browser's padlock only says that the connection to the terminating component is encrypted and authenticated; everything beyond it depends on your architecture, and whoever operates that component, such as a CDN provider, can read the traffic. Choosing where to terminate also decides where certificates must be installed and renewed, where mTLS client certificates can be checked, and what the application loses. After termination, the backend no longer sees the client's TLS details or original IP address unless the proxy forwards them in headers such as X-Forwarded-For and X-Forwarded-Proto, or with the PROXY protocol.

Example

TLS passthrough with nginx's stream module, routing by SNI without decrypting:

stream {
    map $ssl_preread_server_name $backend {
        app.example.com  10.0.0.11:443;
        default          10.0.0.12:443;
    }
    server {
        listen 443;
        ssl_preread on;
        proxy_pass $backend;
    }
}

Here TLS terminates on the backends, which therefore need the certificates. Replacing this with an http server block that has ssl_certificate moves termination to nginx.

Common misconceptions

• The padlock means traffic is encrypted all the way to the application. It covers only the hop to the termination point.
• TLS must terminate on the application server to be secure. Terminating at a proxy is normal; what matters is protecting the hop behind it, by re-encryption or network isolation.
• A passthrough proxy can add headers or cache responses. Without decrypting, it sees only the SNI and encrypted bytes.