Configure SSL offloading with end-to-end encryption

Last published : Sep 30, 2026
A simple SSL offloading setup terminates SSL traffic (HTTPS), decrypts the SSL records, and forwards the clear text (HTTP) traffic to the back-end web servers. Clear text traffic is vulnerable to being spoofed, read, stolen, or compromised by individuals who succeed in gaining access to the back-end network devices or web servers.
You can, therefore, configure SSL offloading with end-to-end security by re-encrypting the clear text data and using secure SSL sessions to communicate with the back-end Web servers.
Configure the back-end SSL transactions so that the appliance uses SSL session multiplexing to reuse existing SSL sessions with the back-end web servers. It helps in avoiding CPU-intensive key exchange (full handshake) operations and also reduces the overall number of SSL sessions on the server. As a result, it accelerates the SSL transaction while maintaining end-to-end security.
To configure an end-to-end encryption deployment, perform the following steps:
  • Create SSL services
  • Create an SSL virtual server
  • Add a certificate-key pair
  • Bind the certificate-key pair to the SSL virtual server
  • Bind the services to the SSL virtual server
For information about adding services, virtual servers, certificate-key pairs, see SSL offloading configuration.
Sample values used in the configuration are listed in the table
Entity Name IP Address Port
SSL service service-ssl-1 198.51.100.5 443
SSL service service-ssl-2 198.51.100.10 443
SSL virtual server vserver-ssl 203.0.113.5 443
SSL certificate-key pair certkey-1 NA NA
Example:
add service service-ssl-1 198.51.100.5 SSL 443

add service service-ssl-2 198.51.100.10 SSL 443

add lb vserver vserver-ssl SSL 203.0.113.5 443

add ssl certKey certkey-1 -cert server_rsa_1024.pem -key server_rsa_1024.ky

bind ssl vserver vserver-ssl -certkeyName certkey-1

bind lb vserver vserver-ssl service-ssl-1

bind lb vserver vserver-ssl service-ssl-2
Related information
How-to articles

Configure SSL offloading with end-to-end encryption using the GUI

  1. Navigate to Traffic Management > Load Balancing > Services > Add.
  2. Add two services: service-ssl-1 and service-ssl-2.
  3. Navigate to Traffic Management > SSL > Certificates > Install.
  4. Add a certificate-key pair: certkey-1.
  5. Navigate to Traffic Management > Load Balancing > Virtual Servers > Add.
  6. Add a virtual server: vserver-ssl.
  7. Click OK.
  8. Click inside Load balancing Virtual Server Service Binding.
  9. In Select Service, click the arrow.
  10. In the Service dialog box, select service-ssl-1 and service-ssl-2.
  11. Click Select.
  12. Click Bind.
  13. Click Continue.
  14. In the Certificate section, click Server Certificate.
  15. In Select Server Certificate, click the arrow.
  16. In the Server Certificates dialog box, click certkey-1.
  17. Click Select.
  18. Click Bind.
  19. Click Continue.
  20. Click Done.
SSL offloading with end to end encryption