TLS termination, sometimes called SSL offloading, is the practice of ending the encrypted connection at an edge component such as a load balancer, CDN or reverse proxy. That component holds the certificate, decrypts incoming traffic and passes plain or re-encrypted requests to your application servers.
Why it matters
Centralizing certificates makes renewals simpler and moves CPU work off application servers. It also lets the edge inspect traffic for caching, routing and WAF rules.
The catch is that your application no longer sees HTTPS directly. It receives HTTP from the proxy and must trust headers such as X-Forwarded-Proto to know the original scheme. Get this wrong and you can see redirect loops, mixed-content links or cookies without the Secure flag. Traffic between the proxy and backend is unencrypted unless you configure "re-encryption" or end-to-end TLS, which matters on shared networks.
Example
location / {
proxy_pass http://app_backend;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
}The application then checks X-Forwarded-Proto before deciding whether to redirect to HTTPS.
Common mistakes
- Redirecting to HTTPS in the app without honoring the forwarded scheme, causing an infinite loop.
- Trusting forwarded headers from any client instead of only the proxy.
- Leaving the proxy-to-origin hop unencrypted on an untrusted network.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.