SSL Termination Explained
Where encryption ends
SSL termination is the point at which an encrypted TLS connection is decrypted. Where that happens depends on the setup. On a simple server, the web server itself terminates TLS. When a load balancer, reverse proxy or content delivery network (CDN) sits in front, that edge device often terminates it instead.
The edge device handles the handshake with the visitor, decrypts the request and forwards it to the origin server, which is the machine that holds the site. Terminating at the edge can offload work from the origin, allow one place to manage certificates and make it easier to inspect or cache traffic. The HTTPS protection the visitor sees covers only the first leg of the journey.
Encryption between the edge and the origin
The second connection, from the edge to the origin server, can be encrypted or plain. This choice defines the common modes offered by hosting platforms and CDNs, although the names differ between providers.
In a flexible setup, the visitor's connection is encrypted but the edge talks to the origin over plain HTTP. The visitor sees the padlock, yet traffic between the edge and the origin can be read by anyone on that path. This is a weaker arrangement, and it can cause redirect loops when the origin forces HTTPS.
In a full setup, the edge re-encrypts the connection to the origin but may accept any certificate there, including a self-signed one. The traffic is protected from casual eavesdropping, but the edge cannot confirm that it reached the real origin.
In a strict setup, the edge encrypts the connection and verifies the origin certificate against a trusted authority or a known certificate. This gives the strongest guarantee, because both hops are encrypted and authenticated.
Origin certificates and why they exist
An origin certificate is a certificate installed on the origin server, usually issued by the CDN or hosting platform for use only between the edge and the origin. Visitors never see it, because the edge presents its own public certificate. Its purpose is to allow strict verification without requiring a public certificate on the origin.
Origin certificates involve a trade-off. They are simpler to deploy than a full public setup, but they are trusted only by the provider's edge, so a direct connection to the origin will fail verification. Knowing where the trust boundaries sit is the key to choosing a mode.
Frequently asked questions
Is flexible SSL secure?
It encrypts the visitor's connection but not the link between the edge and the origin. Anyone who can observe that internal path can read the traffic. For sensitive data, such as logins or payments, a setup that encrypts both hops is considered the safer choice.
Does SSL termination make a site less private?
Not necessarily, but it changes who sees the data. The edge device decrypts each request, so the provider running it can read the traffic. Visitors should understand that trust extends to that provider as well as to the origin server.