SSL-terminatsiya va muvozanatlash
Qisqacha xulosa
SSL/TLS-terminatsiya ilovalardan kripto yukini olib tashlaydi va L7-marshrutizatsiya, WAF, rate-limit, mTLS, kanareya relizlariga yo’l ochadi. Asosiy yechimlar: TLSni qayerda tugatish (edge/ingress/mesh ichida), qanday muvozanatlash (L4 vs L7), qaysi shifr profillarini ishlatish, sertifikatlarni dauntaymsiz qanday yangilash va SLOda p95 latentlik va xatolarni qanday saqlash.
TLSni qayerda tugatish kerak
Chetda (CDN/Anycast/WAF): foydalanuvchi uchun minimal maxfiylik, global himoya, kesh/bot nazorati. Keyingi - re-encrypt.
Ingress L7 da (Nginx/Envoy/HAProxy/ALB): URI/sarlavhalar bo’yicha nozik marshrutlash, mTLS, JWT-validatsiya.
To’liq TLS (passthrough L4): end-to-end mTLS to pod/service (masalan, qattiq komplayens zona) kerak bo’lganda.
Service Mesh (Envoy/Istio/Linkerd): klaster, siyosat va telemetriya ichida avtomatlashtirilgan mTLS.
Amaliyot: ko’pincha - edge terminate → re-encrypt to ingress; PII/to’lovlar uchun - servisgacha mTLS.
L4 vs L7 balanslash
L4 (TCP/UDP): minimal kechikish, oddiy health-checks (port/TSR), passthrough TLS. TLSdagi gRPC uchun mos L7-fich mavjud boʻlmaganda.
L7 (HTTP/HTTPS/HTTP3): xost/yo’l/sarlavha/cookies, WAF, rate-limits, kanareya relizlari, sticky-sessiyalar, retray/taymautlar.
TLS: versiyalar, kalitlar, shifrlar
Versiyalar: TLS 1. 3 hamma joyda, TLS 1. 2 fallback sifatida. 1 oʻchiring. 0/1. 1.
Kalitlar/sertlar: ECDSA (P-256) - RSA tezroq; eski uchun ikki-stek (ECDSA + RSA) bo’lishi mumkin.
ALPN: `h2` и `http/1. 1`; HTTP/3 uchun -’h3’(QUIC/UDP).
OCSP Stapling: qoʻshish; HSTS ochiq domenlarda.
Kalit pullari: KMS/HSMda saqlash; avtomatik uzaytirish (ASME/ishonch daraxti).
0-RTT (TLS 1. 3): nuqtali (GET/idempotent), replay xavfini hisobga olish.
Asosiy shifr profili (TLS 1. 2): `ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305`
TLS quvvati
Resumption: session tickets/IDs - handshake qiymatini pasaytiradi.
ECDSA + ChaCha20 mobil/AES-NIsiz yordam beradi.
OCSP Stapling + qisqa zanjirlar p95 ni kamaytiradi.
HTTP/2/3: multiplekslash, kamroq birikmalar → p95 dan past.
Offload: crypto ostida pin CPU yadrolari, reuseport, tune socket-buferlarni yoqish.
Xavfsizlik
mTLS: ma’murlar/API operatorlari uchun client-cert talab qiling; Koʻrib chiqish uchun CRL/OCSP.
SNI/ECH: SNI - standart; ECH (Encr. ClientHello) domenni yashiradi (agar edge-provayder qoʻllab-quvvatlasa).
Strict Transport Security (HSTS): prod-domenlar, boshlanishda ehtiyotkorlik bilan.
Hop-lar orasidagi TLS: Service to re-encrypt, hatto DC (Zero-Trust) ichida.
Rate-limit/grey-vollar: L7 da apini bot/brutforsdan himoya qiladi.
Kuzatuv va SLO
SLO (misollar)
p95 TLS-handshake ≤ 80-120 ms (global), p95 TTFB ≤ 200-300 ms.
TLS xatolari (handshake/peer-verify) ≤ 0. 1%.
Takroriy tashriflar uchun rezyumpshenlar ulushi 70 foizni ≥.
Metrika
`handshake_time`, `tls_version`, `alpn`, `cert_expiry_days`, `ocsp_staple_status`.
L7: `p50/p95/p99`, `5xx`, `429`, `upstream_rq_time`, `retry_budget`.
Capacity: aktiv konnektlar, CPS (connections per second), RPS.
Namunaviy konfiglar
Nginx (L7 terminate + HTTP/2 + OCSP stapling)
nginx server {
listen 443 ssl http2 reuseport;
server_name api.example.com;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:...:ECDHE-RSA-CHACHA20-POLY1305';
ssl_ecdh_curve X25519:P-256;
ssl_certificate /etc/ssl/cert.pem; # полная цепочка ssl_certificate_key /etc/ssl/key.pem;
ssl_stapling on; ssl_stapling_verify on;
ssl_session_cache shared:SSL:50m; ssl_session_timeout 1d;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
location / {
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto https;
proxy_pass https://upstream_pool;
}
}
upstream upstream_pool {
zone backends 64k;
server 10.0.1.10:8443 max_fails=3 fail_timeout=10s;
server 10.0.1.11:8443 max_fails=3 fail_timeout=10s;
keepalive 256;
}HAProxy (L7 terminate + stickiness + mTLS to backend)
haproxy frontend fe_https bind:443 ssl crt /etc/haproxy/certs/ alpn h2,http/1.1 mode http http-response set-header Strict-Transport-Security max-age=31536000 default_backend be_api
backend be_api mode http balance roundrobin cookie SRV insert indirect nocache option httpchk GET /healthz server s1 10.0.1.10:8443 check ssl verify required ca-file /etc/haproxy/ca.pem server s2 10.0.1.11:8443 check ssl verify required ca-file /etc/haproxy/ca.pemEnvoy (L7 terminate + mTLS mijozdan + kanareyka)
yaml static_resources:
listeners:
- name: https address: { socket_address: { address: 0.0.0.0, port_value: 443 } }
filter_chains:
- filters:
- name: envoy.filters.network.http_connection_manager typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager stat_prefix: ingress route_config:
virtual_hosts:
- name: api domains: ["api.example.com"]
routes:
- match: { prefix: "/" }
route:
weighted_clusters:
clusters:
- name: api-stable weight: 95
- name: api-canary weight: 5 http_filters:
- name: envoy.filters.http.router transport_socket:
name: envoy.transport_sockets.tls typed_config:
"@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext common_tls_context:
tls_certificates:
- certificate_chain: { filename: "/etc/tls/cert.pem" }
private_key: { filename: "/etc/tls/key.pem" }
validation_context: # mTLS (опционально)
trusted_ca: { filename: "/etc/tls/ca.pem" }
require_client_certificate: trueAWS ALB/NLB (kontseptsiya)
ALB (L7 terminate): HTTPS listener 443 (TLS 1. 2/1. 3), target group HTTPs:8443, health-check `/healthz`, stickiness (cookie).
NLB (L4 passthrough): TLS listener 443, TCP health-checks, SNI orqali pod.
CloudFront/Cloudflare: TLS edge + WAF + Bot-menejment; origin — HTTPS only.
Sertifikatlarni dauntaymsiz yangilash
ACME (Let’s Encrypt/Xususiy CA) avtomatik yangilanish va issiq qayta ishga tushirish (Nginx’reload’, Envoy SDS).
Migratsiyalarda ikki tomonlama sertifikatlar (ECDSA + RSA).
Zanjirlarni nazorat qilish: oraliq CAlarni tekshirish; Rotatsiyadan keyin OCSP stapling.
Alertlar:’cert _ expiry _ days <21’va’ocsp _ status! = good’.
Health-checks va marshrutlash
L4: TCP connect, TLS handshake.
L7: HTTP 200/JSON-marker versiyasi, gRPC health.
Siyosatlar: failover, weighted, latency, consistent-hash (cookie/IP) uchun sticky.
Retrai/taymautlar: barqarorlik va so’rovlarning dublikatlari o’rtasidagi balans (idempotentlik!).
Kubernetes-patternlar
Ingress Controller (Nginx/Envoy/HAProxy): ingresdagi terminatsiya, DNS yozuvlari uchun’ExternalDNS’, ACME uchun’cert-manager’.
Gateway API: kanaryalar bilan TLSRoute/HTTPRoute deklarativ.
Service Mesh: avtomatik mTLS pod, «PeerAuthentication »/« DestinationRule» darajasidagi siyosatlar.
Xavfsizlik chek-varaqasi
- TLS 1. 3 kiritilgan; 1. 0/1. 1 oʻchirilgan.
- Zamonaviy shifrlar; ECDSA sertlari qo’llab-quvvatlash mumkin bo’lgan joylarda.
- OCSP stapling, to’liq zanjirlar, HSTS.
- ma’murlar/interkonnektlar uchun mTLS; mijoz sertlarini revokatsiya qilish.
- Rate-limit/chetidagi bot-filtrlar; slowloris/oversized headers dan himoya qilish.
- Re-encrypt to backends (Zero-Trust).
- KMS/HSM sirlari/kalitlari; rotatsiya va berish auditi.
Kuzatuv va alertlar
Метрики: TLS handshakes/sec, failure rate, session resumption rate, OCSP, p95/99, open conns, CPS, RPS.
Logi: SNI/ALPN/TLS versiyasi, cipher, mijoz sertifikati (mTLS uchun), upstream-kodlar, latency breakdown.
Alertlar:’5xx/525’, resumption,’cert _ expiry _ days’,’ocsp _ failed’, p95 dan oshgan,’429’portlashlar.
Tipik xatolar
Chetdagi terminatsiya va plain HTTP himoyasiz ichkariga.
Haddan tashqari uzun zanjirlar CA → balandligi p95 handshake.
OCSP stapling → mijozlar/brauzerlarda blokirovka mavjud emas.
Sticky-seanslar failover → degradatsiya tugunida «yopishish».
0-RTT oʻzgartiruvchi soʻrovlar uchun yoqilgan
Rotatsiya paytida hot-reload sertlari → sekundlik droplar yo’qligi.
iGaming/fintech uchun xususiyatlar
Piki (turnirlar/o’yinlar): TLS-sessiyalarni isitish (pre-connect), qisqa zanjirlar, yuqori resumption ulushi, frontlar uchun HTTP/2/3.
To’lov shlyuzlari/PSP: mTLS, qat’iy ciphers/versiyalar, pinned CA, qat’iy qoidalarga ega alohida domenlar/ALB.
Antifrod/bot-filtrlar: IP/ASN/device-fingerprint bo’yicha L7-rate-limit, alohida domenda kanareykali grey-vollar (challenge/kapcha).
Regulyator: HSTS, audit qilinadigan TLS-parametrlar jurnallari, versiyalar bo’yicha hisobotlar, hodisalar bo’yicha mijoz sertifikatlarini chaqirib olish.
Mini pleybuklar
L7-balanslash vositasi orqali kanar relizi
1. Og’irligi 5% bo’lgan’api-canary’klasterini qo’shing; 2) p95/xatolarni kuzatib boring; 3) 5→25→50→100%; 4) tanazzulga uchraganda avto-burilish.
Sertifikatni shoshilinch almashtirish
1. Yangi cert/key yuklansin; 2) konnektlar tushmasdan’reload’(SDS/issiq almashtirish); 3) OCSP tekshiruvi; 4) dashbord p95 handshake.
HTTP/3 qoʻshish
1. UDP/443 oching; 2) ALPN’h3’qo’shing; 3) alohida QUIC loss/RTT metrikalari; 4) mijozlar ulushi bo’yicha A/B.
Jami
Samarali SSL terminatsiyasi - bu zamonaviy TLS profili, to’g’ri tugallash joyi, aqlli L7 yo’nalishi, kuzatish va qat’iy xavfsizlik (mTLS, HSTS, re-encrypt). Hamma narsani IaC ga o’rnating, rotatsiyalarni avtomatlashtiring, p95/xatolarni o’lchang va kanareykalardan foydalaning - shunda front cho’qqilardan omon qoladi va tezkor va xavfsiz bo’ladi.