Configuring TCP SSL Listener

Recent Pages

Configuring TCP SSL Listener

Last updated: 2024-10-10 10:42:30

You can create a TCP SSL listener for a Cloud Load Balancer (CLB) instance to forward encrypted TCP requests from the client. TCP SSL is applicable to scenarios where ultra-high performance and large-scale TLS offloading are required. Real servers bound to the TCP SSL listener can directly obtain the real client IP address.
Note:
TCP SSL listeners currently support CLB instances but not classic CLB instances.
Use Cases
TCP SSL is suitable for scenarios that have high requirements for security when the TCP protocol is used:
TCP SSL listeners support configuration of certificates to block unauthorized access.
Unified certificate management is supported for CLB to implement decryption.
One-way authentication and mutual authentication are supported.
A real server can directly obtain the client IP address.
Prerequisites
You have created a CLB instance. For more information, see Creating CLB Instances.
Directions
Step 1. Configure a listener
1. Log in to the CLB console and click Instance management in the left sidebar.
2. Select your region in the top-left corner of the CLB instance list and click Configure listener in the Operation column of the target instance.
﻿
﻿
3. Under TCP/UDP/TCP SSL/QUIC listener, click Create and configure the TCP SSL listener in the pop-up window.
3.1  Configure basic parameters
Parameter
Description
Example
Name
Listener name.
test-tcpssl-9000    
Listening protocol and port
Listening protocol: In this case, select TCP SSL.
Listening port: The port used to receive requests and forward them to the real server. The port number ranges from 1 to 65535.
A listening port must be unique in the same CLB instance.
TCP SSL:9000
SSL parsing
One-way authentication and mutual authentication are supported.
One-way authentication
Server certificate
You can select an existing certificate in the SSL Certificate Service console or create a certificate.
Select an existing certificate.
Balancing method
CLB supports two scheduling algorithms for TCP SSL listeners: weighted round robin (WRR) and weighted least connections (WLC).
WRR: Requests are distributed to real servers in sequence based on their weights. This algorithm performs scheduling based on the number of new connections. Servers with higher weights are more likely to be scheduled and servers with the same weight process the same number of connections.
WLC: Loads of servers are estimated based on the number of active connections to the servers. This algorithm performs scheduling based on server loads and weights. For servers with the same weight, those have less loads are more likely to be scheduled.
WRR
3.2 Configure health check
For more information, see TCP SSL Listener.
3.3 Configure session persistence
TCP SSL listeners don't support session persistence currently.
Step 2. Bind a real server
1. On the Listener management page, click the created listener TCP SSL:9000 to view the bound real servers on the right of the listener.
2. Click Bind, select the target real server, and configure the server port and weight in the pop-up window.
Note:
 If you set Default port first and then select real servers, the port of every real server is the default port.
Step 3. Configure a security group (optional)
You can configure a CLB security group to isolate public network traffic. For more information, see Configuring a CLB Security Group.
Step 4. Modify or delete a listener (optional)
If you need to modify or delete a created listener, click the listener on the Listener management page and click 
﻿
 for modification or 
﻿
 for deletion.

Contact Us

Contact our sales team or business advisors to help your business.

Technical Support

Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

7x24 Phone Support

tencent cloud

Recent Pages

Configuring TCP SSL Listener

Use Cases

Prerequisites

Directions

Step 1. Configure a listener

Step 2. Bind a real server

Step 3. Configure a security group (optional)

Step 4. Modify or delete a listener (optional)

Was this page helpful?

Was this page helpful?

Parameter	Description	Example
Name	Listener name.	test-tcpssl-9000
Listening protocol and port	Listening protocol: In this case, select `TCP SSL`. Listening port: The port used to receive requests and forward them to the real server. The port number ranges from 1 to 65535. A listening port must be unique in the same CLB instance.	TCP SSL:9000
SSL parsing	One-way authentication and mutual authentication are supported.	One-way authentication
Server certificate	You can select an existing certificate in the SSL Certificate Service console or create a certificate.	Select an existing certificate.
Balancing method	CLB supports two scheduling algorithms for TCP SSL listeners: weighted round robin (WRR) and weighted least connections (WLC). WRR: Requests are distributed to real servers in sequence based on their weights. This algorithm performs scheduling based on the number of new connections. Servers with higher weights are more likely to be scheduled and servers with the same weight process the same number of connections. WLC: Loads of servers are estimated based on the number of active connections to the servers. This algorithm performs scheduling based on server loads and weights. For servers with the same weight, those have less loads are more likely to be scheduled.	WRR

tencent cloud

Sign Up

Log in

Recent Pages

Configuring TCP SSL Listener

Use Cases

Prerequisites

Directions

Step 1. Configure a listener

Step 2. Bind a real server

Step 3. Configure a security group (optional)

Step 4. Modify or delete a listener (optional)

Was this page helpful?

Was this page helpful?