Apple ATS / Perfect Forward Secrecy requirements as of Jan 1, 2017

[Cantor, Scott]

> The easiest work-around is to run SSL on the webservers and re-configure
> the ACE to do TCP load balancing (versus Layer-7) only. You can still configure
> probes as long as you support a dumb enough cipher for the ACE to
> understand in client-mode (or just do a tcp probe).

It's just very variable how people's load balancers work and what they're comfortable doing, obviously. I've run with TLS terminated at first Apache, then Tomcat, now Jetty, and doing TCP balancing since 2004, and have always been pretty happy with it. We're starting to look at moving to new models with layer 7 proxying now, since I have the backchannel port shut off now.

If it helps, there are no longer serious performance concerns doing TLS in Java directly at OSU's scale, which I suspect approximates School up North's scale (it's November, time to get the hate going).

-- Scott