Forwards TLS connections to a backend without terminating them. Membrane does not decrypt the traffic and can therefore neither inspect nor modify it: the TLS session ends at the backend and the client sees the backend's certificate. Use it in front of services that have to keep an end-to-end encrypted connection to their clients.

Several sslProxy elements can share one port. The server name the client sends in the TLS SNI extension selects the one that handles a connection, so every backend needs its own hostname. Clients that send no server name reach the first proxy on that port with useAsDefault enabled.

See tutorials/ssl-tls/30-TLS-Passthrough.yaml.

Example Configuration

sslProxy:
   host: api.example.com
   port: 8443
   target:
     host: api.example.com
     port: 443

sslProxy:
   host: api.example.com
   port: 8443
   target:
     host: api.example.com
     port: 443

Syntax

sslProxy:
  host: <string> # required
  connection: {}
  interceptors:
    - <interceptors>
  ip: <string>
  port: <int>
  target: {}
  useAsDefault: <boolean>

sslProxy:
  host: <string> # required
  connection: {}
  interceptors:
    - <interceptors>
  ip: <string>
  port: <int>
  target: {}
  useAsDefault: <boolean>

Attributes

Name	Required	Default	Description	Examples
host	true	-	Restricts this proxy to connections whose TLS server name (SNI) matches one of the given hostnames. Separate multiple hostnames with spaces. The asterisk `*` matches any number of characters, including zero, for basic globbing.	api.example.com
ip	false	not set	If present, binds the port only on the specified IP. Useful for hosts with multiple IP addresses.	127.0.0.1
port	false	-	Port the gateway accepts TLS connections on.	8443
useAsDefault	false	true	whether to use the SSLContext built from this SSLProxy when no SNI header was transmitted.	-

Child Structure

Element	Cardinality	Description
connection	0..1	Socket level settings for connections to a backend: how long the client waits while connecting and while reading, how long an idle connection is kept in the pool, and which local network interface it binds to.
interceptors	0..*	Plugins that inspect a connection before it is forwarded and can reject it. They only see the data of the TLS handshake, never the encrypted payload.
target	0..1	Backend the encrypted connection is forwarded to.

Can be used in

No parent elements.