How is TLS termination implemented in AWS NLB?

Question

AWS NLB supports TLS termination https://aws.amazon.com/blogs/aws/new-tls-termination-for-network-load-balancers/

NLB being a Layer 4 load balancer I would expect it to work in a passthrough mode by directing the incoming packets to one of the backends without much of state maintenance (except for the flow tracking)

Are there any details available on how AWS implements the TLS termination in NLB ?

Is it possible to do it with open source tooling (like IPVS or haproxy) or AWS has some secret sauce here ?

Answer 1

The TLS termination itself is just what it says it is. TLS is a generic streaming protocol just like TCP one level up so you can unwrap it at the LB in a generic way. The magic is that they keep the IPs intact probably with very fancy routing magic, but it seems unlikely AWS will tell you how they did it.