ssl Tunneling

SSL for unsecured Servers

A client can establish an encrypted SSL connection to the Membrane Router. The router terminates the SSL channel and communicates in plain HTTP or SOAP with the server. Using this configuration you can provide SSL encryption and authentication even if your service does not provide SSL. The Membrane Router can also doloadbalancing or access control.

Figure1: SSL Encryption for unsecured Server

See also the example/ssl-server directory of the Membrane distribution for example configuration files for this scenario.

SSL Tunnel to the Server

Membrane Router can enable clients that do not support SSL to communicate with a SSL secured server. To secure the connection the traffic is encrypted by the router before it enters the unsecured network.

Figure2: Non SSL Client communicates with secured Server

See also the example/ssl-client directory of the Membrane distribution for example configuration files for this scenario.

Monitoring a SSL Connection

Because a SSL connection is encrypted it is not possible to monitor the traffic between the client and the server. By using two SSL connections, one between client and monitor and one between monitor and server, it is possible to analyze and monitor the traffic. So both client and server think they are communicating point to point securely with their peer.

Figure3: Logging SSL encrypted Traffic

SSL Tunnel and VPN

A SSL tunnel can route traffic between an unsecured client and an unsecured server over the hostile internet. At each organisation a Membrane Router can work as SSL termination point and provide the desired encryption and authentication.

Figure4: SSL VPN Tunnel

Technical Configuration

Inbound and outbound SSL can be configured using thessl element in proxies.xml.