SSL Passthrough in Ingress

[akarX23]

I was having problems with making the NGINX Ingress work with the underlying service cluster-name. It was mainly because the TLS termination occurs at the ingress level and the service needs SSL Communication with the ingress. So I enabled TLS Passthrough and then things worked fine.

What will be the security and performance impacts because of this? If I disable TLS Passthrough and configure Ingress to talk to the service using SSL then there would be 2 SSL handshakes which will definitely cause an impact on performance. Also, we can't disable security so what would be the best option in this case?

I am not very good at this so this might be a naive question but if possible please help out!

[swoehrl-mw]

Hi @akarX23.
The IMO prefered approach is to have nginx do SSL termination and have the two handshakes. This makes it easier to present "good" certificates externally (LetsEncrypt or some other public CA) and use the self-generated ones internally. In my experience the performance penalty of doing two handshakes nowadays is low enough to not have a big impact.