End to end SSL NLB

Question

If we need end-to-end encryption involving NLB, is it mandatory to have a certificate installed on NLB?
Is it possible to pass through the traffic as-is to ec2 and ec2 do the decryption? If so, what would be the listener protocol. Is that TCP or TLS? I believe target group port should be TLS.

Below are the lines from documentation:
 "Note that if you need to pass encrypted traffic to the targets without the load balancer decrypting it, create a TCP listener on port 443 instead of creating a TLS listener. The load balancer passes the request to the target as is, without decrypting it."

However, https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-target-group.html, documentation states that target group protocol of TLS would be acceptable only if listener protocol is TLS.

Answer

> If we need end-to-end encryption involving NLB, is it mandatory to have a certificate installed on NLB?

No, it is not mandatory TLS can be terminated on the backend directly

> Is it possible to pass through the traffic as-is to ec2 and ec2 do the decryption?

Yes

> If so, what would be the listener protocol. Is that TCP or TLS? I believe target group port should be TLS.

TCP-443 as mentioned here:

"Note that if you need to pass encrypted traffic to the targets without the load balancer decrypting it, create a TCP listener on port 443 instead of creating a TLS listener. The load balancer passes the request to the target as is, without decrypting it."

> However, https://docs.aws.amazon.com/elasticloadbalancing/latest/network/create-target-group.html, documentation states that target group protocol of TLS would be acceptable only if listener protocol is TLS.

You would configure Target group protocol as TLS if you are terminating the SSL on the load balancer (Also called as SSL offloading Or two way SSL, i.e. Client -> LB is SSL and then another SSL session from LB -> backend)

End to end SSL NLB

Relevant content