Rapid7, Inc.
Single whitelisted ingress endpoint on 1 and 2 way TLS connections

Abstract:

Disclosed herein are methods, systems, and processes for implementing a single whitelisted ingress endpoint on both one-way and two-way Transport Layer Security (TLS) connections and performing load balancing. Both two-way TLS agent-based traffic and one-way TLS non-agent-based traffic is routed through a single whitelisted internet protocol (IP) endpoint. A TLS connection is transmitted from a network load balancer and to a platform gateway service that operates as a Server Name Indication (SNI) reverse proxy server. The platform gateway service separates out the one-way TLS non-agent-based traffic that is part of the TLS connection based on a TLS header of the TLS connection. The one-way TLS non-agent-based traffic is then selectively terminated on an elastic load balancer.