Is it possible to do SSL Passthru with ALB?

Question

Customer who is using the following design (see below)..

![20200302_EKS_ELB_design-anon](https://user-images.githubusercontent.com/7881713/75723649-ae7f5e80-5caa-11ea-9e19-25d41733488e.jpg)

As of now when the request is passed thru the ALB, we get a HTTP 502 error. The application on the EKS Pods is an IIS-based windows web application which returns this error since it does not get the hostname that is used to hit the ALB. It seems the ALB is removing the hostname and sending the private ip to IIS which then does not recognize its site binding settings.

Please note that this works when the request is made directly via the NLB i.e. when we skip the ALB.

So question is - is there a way to make ALB "pass thru" the hostname **HTTP header** to the IIS server on the EKS pod?

sumitaws · Accepted Answer

If host header is present in the client request, the ALB will passthrough this information. If there is no hostheader in the client request the ALB will insert its own DNS name in the host header.
It is possible that the Ingress controller is stripping the host header information as SSL passthrough it may not be enabled by default

https://docs.giantswarm.io/guides/advanced-ingress-configuration/

A combination of ALB access logs and Ingress controller logs along with the EKS IIS logs can help you identify the issue. Please note that Private IP of the ALB nodes will be used to communicate to the backends but that should not affect the IIS logic which is looking at the host header information.

Is it possible to do SSL Passthru with ALB?

Add your answer

Relevant content