# What Is TLS Termination (SSL termination)? Definition and Examples

> TLS termination is the point where an incoming TLS connection ends and is decrypted, such as a CDN edge, load balancer, reverse proxy or the app server.

Source: https://ssl.sh/glossary/tls-termination/
Last updated: 2026-11-10

TLS termination describes where a client's encrypted connection ends. The component that terminates TLS holds the certificate and [private key](https://ssl.sh/glossary/private-key/), completes the handshake, and from then on sees plaintext requests. Common termination points are a CDN edge, a cloud load balancer, a Kubernetes ingress controller, a [reverse proxy](https://ssl.sh/glossary/reverse-proxy/) such as nginx, or the application server itself. Behind that point traffic may travel in plaintext or be re-encrypted on a new TLS connection to the backend; alternatively, a proxy can skip termination and pass the encrypted stream through to the backend (TLS passthrough).

## Why it matters
The termination point defines your security boundary. The browser's padlock only says that the connection to the terminating component is encrypted and authenticated; everything beyond it depends on your architecture, and whoever operates that component, such as a CDN provider, can read the traffic. Choosing where to terminate also decides where certificates must be installed and renewed, where [mTLS](https://ssl.sh/glossary/mtls/) client certificates can be checked, and what the application loses. After termination, the backend no longer sees the client's TLS details or original IP address unless the proxy forwards them in headers such as `X-Forwarded-For` and `X-Forwarded-Proto`, or with the PROXY protocol.

## Example
TLS passthrough with nginx's stream module, routing by [SNI](https://ssl.sh/glossary/sni/) without decrypting:

```nginx
stream {
    map $ssl_preread_server_name $backend {
        app.example.com  10.0.0.11:443;
        default          10.0.0.12:443;
    }
    server {
        listen 443;
        ssl_preread on;
        proxy_pass $backend;
    }
}
```

Here TLS terminates on the backends, which therefore need the certificates. Replacing this with an `http` server block that has `ssl_certificate` moves termination to nginx.

## Common misconceptions
- **The padlock means traffic is encrypted all the way to the application.** It covers only the hop to the termination point.
- **TLS must terminate on the application server to be secure.** Terminating at a proxy is normal; what matters is protecting the hop behind it, by re-encryption or network isolation.
- **A passthrough proxy can add headers or cache responses.** Without decrypting, it sees only the SNI and encrypted bytes.

## Related terms

- [SSL 卸载](https://ssl.sh/zh/glossary/ssl-offloading/): SSL 卸载是把 TLS 握手和加解密的计算工作从应用服务器转移到专门的代理、负载均衡或硬件设备上。
- [反向代理](https://ssl.sh/zh/glossary/reverse-proxy/): 反向代理是代表后端服务器接收客户端连接、再把请求转发给后端的服务器，通常同时承担 TLS 终止。
- [mTLS](https://ssl.sh/zh/glossary/mtls/): mTLS 是服务器和客户端在握手中都用 X.509 证书向对方证明身份的 TLS，也叫双向 TLS 认证。
- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。
- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [SSL 解密检测](https://ssl.sh/zh/glossary/ssl-inspection/): SSL 解密检测是企业安全网关借助受管设备信任的私有 CA，对 TLS 流量进行解密、检查后再重新加密的做法。