Technology, architecture & business — written by the Brightnous team SSL TERMINATION
Contents
Introduction
When we build web applications, security is essential. HTTPS (SSL/TLS) protects user data in transit using certificates. Instead of configuring SSL separately for every service (Keycloak, Java, PHP, etc.), we can configure SSL once at a front-end server such as Apache or Nginx. This centralized approach is called SSL Termination.
What is SSL Termination?
When a user visits:
the browser establishes an encrypted connection (HTTPS). With SSL Termination, a single server (Apache/Nginx) accepts the HTTPS request, decrypts it (terminates SSL), and forwards the request to backend services over plain HTTP.
Simple flow
- User → HTTPS → Apache/Nginx (port 443)
- Apache/Nginx decrypts SSL (termination)
- Apache/Nginx forwards request → Backend services (HTTP)
This keeps the backend services free from individual SSL configurations while ensuring secure external communication.
Why use SSL Termination?
Centralized certificate management
Only one place to install and renew certificates, reducing clerical errors and operational overhead.
Simpler backend services
Backends do not need SSL setup, which simplifies configuration and debugging.
Performance and optimization
Reverse proxies and web servers are optimized for TLS handling (session reuse, hardware acceleration, etc.).
Network security & reduced attack surface
Only the proxy exposes port 443 to the outside world; internal service ports remain hidden within the network.
Easier updates & rotation
Certificate renewal or edits happen only on the proxy, not on every service.
Architecture Overview
How it works:
User (HTTPS) → Apache / Nginx (Port 443) → HTTP to backends
Example :
User (HTTPS)
↓
Apache/Nginx (Port 443) — decrypts SSL
├─ /auth → Keycloak (HTTP :8080)
└─ /api → Java backend (HTTP :9001)
- Apache performs SSL termination by decrypting the request.
- The user sends an encrypted HTTPS request to the Apache server.
- Apache forwards the unencrypted HTTP request to the appropriate backend server.
- Backend servers process the request and send the response back to Apache.
- Apache encrypts the response and sends it back to the user over HTTPS.
Real project experience (concise, practical)
In my project we had:
- Keycloak for authentication
- Java backend for APIs
Initially, we considered enabling SSL on every service. That approach was time-consuming and harder to maintain. We switched to SSL Termination on Apache:
- Apache handled the SSL certificate on port 443.
- Apache forwarded requests internally to Keycloak (8080) and Java (9001) over HTTP.
Result: certificate management became simple, backend configurations were lighter, and internal ports stayed hidden — overall a faster, safer setup.
Security notes
- Use internal network protections: Although backends receive plain HTTP, ensure they are on an internal network (VPC, private subnet) and not exposed publicly.
- Enable mutual TLS or internal encryption if needed: For very sensitive data, consider encrypting internal traffic too (TLS between proxy and backend) or use mutual TLS.
- Keep the reverse proxy updated: Apply patches and follow TLS configuration best practices (disable old ciphers, enable TLS 1.2/1.3).
- Monitor and log: Centralized logging at the proxy helps trace traffic and detect anomalies.
Conclusion
SSL Termination is a practical, maintainable way to secure web applications. It centralizes certificate handling, simplifies the backends, and reduces operational overhead — making it ideal for multi-service architectures. In my experience, moving SSL to Apache/Nginx saved time and made the system easier to manage while keeping it secure.
