TLS termination
TLS termination is the process of ending a TLS connection and decrypting its traffic at an endpoint or intermediary for processing or forwarding.
Kubernetes for Developers
TLS termination is the process of ending a TLS connection at an intermediary that handles encryption and certificate processing before forwarding the request.
- How it is used
- Exposes HTTPS applications through Ingress while centralizing certificate processing and reducing TLS work in application servers.
- How deep it goes
- Explains termination, re-encryption, passthrough limits, Secrets, and Ingress configuration, but stops short of certificate-authority procedures.
- Examples
- Uses OpenSSL commands, a Kubernetes TLS Secret, an Ingress manifest, and an example.com HTTPS endpoint.
- What you can do after
- Configure TLS termination with Kubernetes Ingress, a TLS Secret, and certificate and key files.
Read how Kubernetes for Developers explains TLS termination →
Learn Docker in a Month of Lunches, Second Edition
SSL termination is the process of ending an SSL or TLS connection at an intermediary such as a reverse proxy before forwarding the request internally.
- How it is used
- Centralizes HTTPS certificates and client encryption at a reverse proxy serving multiple internal application components.
- How deep it goes
- Walks through certificate generation, mounted files, proxy configuration, redirects, reloads, and verification, but not certificate-authority operations.
- Examples
- Uses Nginx, self-signed certificates, image-gallery.local, Traefik labels, HTTPS curl requests, and HTTP-to-HTTPS redirects.
- What you can do after
- Operate HTTPS termination with Nginx or Traefik and verify redirects, certificates, and proxied application endpoints.
Read how Learn Docker in a Month of Lunches, Second Edition explains TLS termination →
Kubernetes in Action, Second Edition
TLS termination is the process of ending a TLS connection at an intermediary, such as a reverse proxy, so that subsequent traffic can be handled as plaintext or re-encrypted.
- How it is used
- Secures publicly exposed services while allowing an Ingress proxy or gateway to handle HTTPS for HTTP backends.
- How deep it goes
- Shows certificate creation, Secret references, listener settings, hostname matching, testing, and optional TLS settings without detailing cryptographic internals.
- Examples
- Uses OpenSSL and kubectl commands, Ingress YAML, Gateway YAML, and curl requests against kiada.example.com.
- What you can do after
- Operate/configure TLS termination by creating a TLS Secret and attaching it to an Ingress or Gateway listener.
Read how Kubernetes in Action, Second Edition explains TLS termination →
Software Security for Developers
TLS termination is the process of decrypting and handling a TLS connection at an endpoint before forwarding the resulting traffic.
- How it is used
- Centralizes HTTPS handling at a Kubernetes ingress before routing requests to application services.
- How deep it goes
- Explains endpoint choice, certificate management, forwarding boundaries, and application configuration without entering protocol internals.
- Examples
- Uses NGINX Ingress configuration, Spring Boot TLS properties, and internal service-to-service mTLS as examples.
- What you can do after
- Operate/configure TLS termination at ingress or inside Spring Boot while choosing an appropriate internal encryption boundary.
Read how Software Security for Developers explains TLS termination →
Related concepts
- TLSuses · Transport Layer Security (TLS) is a cryptographic protocol that protects network communications through confidentiality, integrity, and authentication of communicating endpoints.
- API gatewayused by · An API gateway is an intermediary that provides an entry point for client requests to backend APIs or services and routes or otherwise mediates those requests.
- reverse proxyimplemented by · A reverse proxy is a server-side intermediary that receives client requests, forwards them to backend servers or services, and relays their responses to clients.
- encryption in transitcontrasts with · Encryption in transit is the protection of data by encrypting it while it is transmitted between systems over a network.
- passthroughalternative to · Passthrough is a gateway TLS mode that forwards encrypted TLS traffic without terminating the TLS session.
- certificateuses · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.