I started to setup a Reverse Proxy on Windows Server 2012 R2 with IIS and the AAR module installed (but purely as a Reverse Proxy without load balancing). It was relatively easy to setup a URL Rewrite with SSL Offloading, but I can't get it run without SSL Offloading. As I'm still trying to resolve that problem, I read a lot about SSL Offloading, but I don't fully understand, why everyone seem to prefer it. All articles I found about reverse proxies always require SSL Offloading to be active, but I couldn't find any articles where the admin recommends to disable SSL Offloading. Why? As I understand, SSL Offloading takes away the load on the backend servers to encrypt and decrypt the data. This makes sense if the servers are under heavy load or expect heavy traffic. However, for a small-to-medium company where traffic is minor, it doesn't seem to make much sense. With SSL Offloading, traffic between the Reverse Proxy and the backend servers is not encrypted and therefore not secure, isn't that a high security risk? Why would a sys admin prefer non-encrypted network traffic? The only other reason I found why everyone seems to prefer SSL Offloading is, because you only need to install the certificates on the Reverse Proxy rather than all backend servers. But come on, installing a certificate on a Windows Server takes 1-2 minutes and we only have to do that once a year anyway. This is nothing compared to other recurring tasks of a server admin...

What am I missing here? Is the speed difference that extreme, that having unencrypted data is easily accepted?

  • Welcome to Webmasters!
    – closetnoc
    Sep 27, 2019 at 15:05


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.