Which SSL offload setting should be configured to provide end-to-end encryption with caching and compression for an externally accessible website?

• A. SSL front-end, SSL back-end
• B. SSL_TCP front-end, SSL_TCP back-end
• C. SSL front end, HTTP back-end
• D. SSL_TCP front-end, TCP back-end

Answer: (B)

To have end-to-end encryption while still enabling caching and compression, the SSL/TLS must be present on both legs of the path: from the client to the ADC and from the ADC to the backend server. The ADC then can decrypt the client’s HTTP for caching and compression, while the traffic to the origin remains encrypted.

Using TLS on both the front-end and the back-end (the SSL_TCP configuration on both sides) achieves this. On the front-end, the ADC terminates TLS with the client, so it can inspect and optimize the HTTP traffic. On the back-end, the ADC speaks TLS to the origin, preserving encryption all the way to the backend server. This combination provides end-to-end security and allows the ADC to perform caching and compression since it can work with decrypted HTTP at the edge.

If the backend path isn’t encrypted (for example, plain HTTP or TCP without TLS), the encryption ends at the ADC and isn’t preserved to the origin, defeating end-to-end encryption. Similarly, if the front-end isn’t handling TLS, client traffic isn’t protected on the public path.