I've read a lot of AWS documentation & just wanted to get my knowledge about NLBs & ALBs straight, because I also found out that there are many workarounds for each case scenario.
For E2E encryption (optimize CPU performance) → configure a TCP listener on port 443 (not a TLS listener).
For SSL/TLS termination & encryption in-transit → configure a TLS listener on port 443 & configure the Target group protocol as TLS on port 443:
- Client → SSL on LB → SSL on backend
- Is the information mentioned above correct?
- Is the main goal of doing SSL/TLS termination & encryption in-transit to serve clients HTTPS using an NLB? Because there will be less performance / more latency as the ssl handshake will happen by the LB & by the EC2.