title: Secure connections between client, load balancer and server
body: <p>The past week or so I have been getting to grips with the world of AWS and more specifically Elastic Beanstalk and Load Balancing...</p>
  
  <p>The application I'm developing enforces a SSL/HTTPS connection using a custom RequireHttps attribute I'm applying globally. I initially had problems configuring the load balancer with this set up, but it does appear to be working as expected.</p>
  
  <p>My problem originates from <a href="http://blog.dontpaniclabs.com/post/2012/12/19/Redirecting-to-HTTPS-while-using-Amazons-Elastic-Load-Balancer.aspx" rel="nofollow">a blog post</a> I was glancing over around the time I was setting up the Load Balancer/RequireHttps attribute. Quoting this blog post:</p>
  
  <blockquote>
    <p>When using Elastic Beanstalk ... the connection between the load balancer and application server is not secure. However, <strong>you don't need to be concerned with the security of the connection between the load balancer and the server</strong> but you do need to be concerned about the connection between the client and the load balancer.</p>
  </blockquote>
  
  <p>As configuring load balancers is an entirely new area for me, I'm a little sceptical that the above is entirely true.</p>
  
  <p>Is the connection between a load balancer and server truly none of my concern? Would it be better to <em>not</em> terminate SSL at the Load Balancer and pass a sercure connection straight through to the server?</p>