|
| 1 | +[nginx-sidecar]: ../installation/kubernetes/sidecar-proxy/deployment.md |
| 2 | +[ssl-termination]: ../installation/kubernetes/sidecar-proxy/customization.md#ssltls-termination |
| 3 | +[nginx-aio]: ../installation/inline/compute-instances/linux/all-in-one.md |
| 4 | +[nginx-docker]: ../admin-en/installation-docker-en.md |
| 5 | + |
| 6 | + |
| 7 | +# SSL/TLS Certificate Management |
| 8 | + |
| 9 | +This article explains what certificates are required, how to manage certificates, how Wallarm nodes handle HTTPS traffic, and where and how to terminate SSL/TLS. |
| 10 | + |
| 11 | +## Certificate requirements |
| 12 | + |
| 13 | +* Supported format: PEM for both certificate and private key files. |
| 14 | +* Key types and sizes: Any key size supported by OpenSSL/NGINX, including 2048-bit, 4096-bit, and ECDSA keys. |
| 15 | +* Cipher suites: Defined and managed through standard NGINX/OpenSSL configuration. |
| 16 | + |
| 17 | +## Certificate issuance and management |
| 18 | + |
| 19 | +Wallarm does not issue, manage, or automatically renew certificates. All certificates must be provided and managed by clients. |
| 20 | + |
| 21 | +You need to: |
| 22 | + |
| 23 | +1. Issue a certificate from a trusted Certificate Authority (CA). |
| 24 | +1. Deploy the certificate to Wallarm nodes. |
| 25 | +1. Renew the certificate before it expires. |
| 26 | + |
| 27 | +To automate these actions, you can use external tools, e.g., [Certbot](https://certbot.eff.org/), [HashiCorp Vault](https://developer.hashicorp.com/vault), [Kubernetes cert-manager](https://cert-manager.io/), [Ansible playbooks](https://docs.ansible.com/projects/ansible/devel/playbook_guide/playbooks_intro.html), or others. |
| 28 | + |
| 29 | +## SSL/TLS termination |
| 30 | + |
| 31 | +SSL/TLS certificates protect network communications between: |
| 32 | + |
| 33 | +* Wallarm nodes and the Wallarm Cloud |
| 34 | +* Wallarm administrators (workstations) and the Wallarm Cloud Console UI and API |
| 35 | + |
| 36 | +By securing these channels, SSL/TLS certificates allow Wallarm to safely decrypt and analyze HTTPS traffic to detect and block threats. |
| 37 | + |
| 38 | +SSL/TLS termination is the process of decrypting encrypted HTTPS traffic at a network endpoint. |
| 39 | + |
| 40 | +Wallarm needs to have decrypted HTTPS traffic to inspect HTTP data (URL, headers, body), detect threats, and block malicious requests. |
| 41 | + |
| 42 | +The configuration and location of SSL/TLS termination depend on your Wallarm [deployment type](../installation/nginx-native-node-internals.md). |
| 43 | + |
| 44 | +### SSL/TLS termination in the NGINX Node |
| 45 | + |
| 46 | +* [Sidecar][nginx-sidecar] |
| 47 | + |
| 48 | + By default, the Wallarm Sidecar solution does not handle SSL/TLS termination. It expects an upstream component (e.g., Ingress or Application Gateway) to handle HTTPS while the Sidecar solution receives plain, decrypted HTTP. |
| 49 | + |
| 50 | + However, if your infrastructure cannot terminate SSL/TLS upstream, you can [enable SSL/TLS termination directly in the Wallarm Sidecar][ssl-termination]. |
| 51 | + |
| 52 | +* [All-in-one installer][nginx-aio], [Docker image][nginx-docker], and cloud images: |
| 53 | + |
| 54 | + The NGINX Node handles SSL/TLS termination. In this case, the node acts as an HTTPS endpoint and must be configured with an SSL/TLS certificate and private key. To set up SSL/TLS termination, edit the [NGINX configuration ](https://nginx.org/en/docs/http/configuring_https_servers.html): |
| 55 | + |
| 56 | + * [`ssl_certificate`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) - specifies the PEM-format certificate file, including the full certificate chain. |
| 57 | + * [`ssl_certificate_key`](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate_key) - specifies the PEM-format private key file. |
| 58 | + |
| 59 | +### SSL/TLS termination in the Native Node |
| 60 | + |
| 61 | +The Native Node **does not handle SSL/TLS termination** and never acts as an inline traffic endpoint. It always analyzes a copy of traffic, not the original client connection. |
| 62 | + |
| 63 | +HTTPS traffic must be decrypted before a copy is sent to the Native Node. SSL/TLS termination is performed by an upstream or adjacent component, e.g., a load balancer, reverse proxy, application delivery controller (ADC), ingress controller, a connector. |
| 64 | + |
| 65 | +The terminating component decrypts HTTPS traffic and sends a decrypted traffic copy to the Native Node for analysis. For configuration details, refer to the documentation of the chosen component. |
0 commit comments