Proxies, TLS, and Injecting Security Into Cloud Communication

Susan Hinrichs

2019-09-10 15:30 #contentdelivery

With the expansion of moving legacy applications into public clouds, there have been an increased need for features in proxies to inject security into legacy application deployments. In this talk, we present extensions made to the Apache Traffic Server proxy over the past two years to enable the secure deployment of legacy applications in a wider variety of network configurations. Specifically, we discuss how Traffic Sever can be used for Layer 4 Routing. In this case, the router does not terminate the TLS connection, but rather use the Server Name Indicator (SNI) to determine were the TLS connection should actually be terminated. Traffic Server configuration additions were also made to allow for the finer-grained deployment of mutual TLS authentication both between the user agent and Traffic Server and between Traffic Server and the origin. A new TLS Bridge plugin allows for the injection of a proxy-to-proxy TLS tunnels to support older applications securely communicating between organizations (e.g. between public cloud and on premise cloud). While we have specifically been working with Traffic Server, our development and production deployment experiences for moving applications into new cross-cloud configurations apply to the problem space in general.