Add a TCP/SSL listener - Server Load Balancer - Alibaba Cloud Documentation Center

Prerequisites

An NLB instance is created. For more information, see Create and manage NLB instances.
A server group is created. For more information, see NLB server groups.

Procedure

This topic describes two methods to create a tcp/ssl listener. Choose the one that best fits your business needs.

Create a tcp/ssl listener: This is the standard method, which allows you to customize features such as Multi-port Listening/Forwarding and Advanced Settings.
Quickly create a tcp/ssl listener: This method allows you to quickly create a listener by configuring only the listener protocol, listener port, server certificate, tls security policy, and the backend server group for request forwarding.

Create a TCP/SSL listener

Step 1: Configure listener

Log on to the NLB console.
In the top navigation bar, select the region in which the NLB instance is deployed.
On the Instances page, find the target instance and use one of the following methods to open the listener configuration wizard.
- In the Actions column, click Create Listener.
- Click the instance ID, and then click the Listener tab. On the Listener tab, click Create Listener above the listener list.
- Click the instance ID. On the instance details page, click Create Listener in the configuration wizard.
- Click the instance ID. In the upper-right corner of the instance details page, click Create Listener.

On the Configure Listener page, configure the following parameters and click Next.

Parameter	Description
Listener Protocol	Select TCPSSL.
Multi-port Listening/Forwarding	Specifies whether to enable this feature. If enabled, the NLB instance listens on all ports within the specified listener port range and forwards requests from these ports to the corresponding ports on backend servers. The server group added to a multi-port listener must also have multi-port forwarding enabled.
Listener Port Range	When the port range feature is enabled, you must enter the start port and the end port for the Listener Port Range. Important After you create a listener, you cannot modify its port range.
Listener Port	Specify the Listener Port used to receive and forward requests to backend servers. You can click a commonly used port or enter a port number. The valid port range is 1 to 65535. This parameter is not required if Multi-port Listening/Forwarding is enabled.
Listener Name	Enter a custom name for the listener.
Tags	Set a Tag Key and Tag Value. After you add a tag, you can filter listeners by tag on the Listener tab.
Advanced Settings	Click Modify to expand the advanced settings.
Idle Connection Timeout Period	Specify the idle timeout for TCP/SSL connections. If no request is received within the timeout period, the NLB instance terminates the current connection. When the next request arrives, the instance establishes a new connection. The valid range is 1 to 900 seconds. The default value is 900. To prevent the NLB instance from closing idle TCP connections, you can enable the TCP Keep-Alive mechanism on the client or server and set the keep-alive interval to a value smaller than the idle timeout of the listener.
Limit on New Connections	Specifies whether to enable connection throttling.
Maximum New Connections per Second	If you enable Limit on New Connections, set the maximum number of new connections per second that the listener can handle in each zone (VIP). Important This limit does not affect other listeners. Their limits depend on their own configurations.
Enable Proxy Protocol	Specifies whether to enable Proxy Protocol to pass client IP addresses to backend servers. For more information, see Obtain client IP addresses by using an NLB instance. Important Important: Proxy Protocol must be supported by both the proxy server (in this case, the NLB listener) and the backend server. If you enable this feature but your backend server cannot parse the Proxy Protocol header, request parsing may fail and impact service availability.
Enable ALPN Policy	Specifies whether to enable Application-Layer Protocol Negotiation (ALPN). ALPN allows clients and servers to better control the protocols over which they communicate to improve performance and security. For example, giving preference to HTTP/2.0 can reduce latency and bandwidth usage. Definition: Application-Layer Protocol Negotiation (ALPN) is a Transport Layer Security (TLS) extension that allows the application layer to negotiate which protocol to use during the TLS handshake. This enables clients and servers to select the most suitable protocol for communication, such as HTTP/1.0, HTTP/1.1, or HTTP/2.0. Description: ALPN is defined in an extension field of the TLS handshake. When you use a tcp/ssl listener with an ALPN policy enabled for an NLB instance, the TLS handshake occurs between the client and the NLB instance. The client sends a list of supported protocols to the NLB instance. The NLB instance selects a protocol from the list and notifies the client of the selected protocol after the handshake is complete.
ALPN Policy	If you enable the ALPN policy, select a policy. HTTP1Only: Uses only HTTP/1.x protocols. Priority: HTTP/1.1 > HTTP/1.0. HTTP2Only: Uses only the HTTP/2.0 protocol. HTTP2Optional: Preferentially uses HTTP/1.x protocols but also supports HTTP/2.0. Priority: HTTP/1.1 > HTTP/1.0 > HTTP/2.0. HTTP2Preferred: Preferentially uses the HTTP/2.0 protocol but also supports HTTP/1.x protocols. Priority: HTTP/2.0 > HTTP/1.1 > HTTP/1.0. If you select HTTP2Optional or HTTP2Preferred, make sure your backend servers support both HTTP/1.x and HTTP/2.0. If the HTTP versions supported by the listener and backend servers are inconsistent, the load balancer cannot properly forward requests. gRPC is based on HTTP/2.0. If the listener forwards gRPC requests, select HTTP2Only as the ALPN policy.

Step 2: Configure SSL certificate

When you add a tcp/ssl listener, you must configure an ssl certificate to encrypt data and authenticate your services. The following table describes the required certificates.

Certificate

Description

One-way authentication

Mutual authentication

Server certificate

Verifies the identity of the server.

Your browser checks whether the certificate sent by the server is issued by a trusted certificate authority (CA). For more information, see What is an ssl certificate?

Yes

You can purchase or upload a server certificate in the Certificate Management Service console. The NLB instance obtains and uses the certificate from the console.

Yes

You can purchase or upload a server certificate in the Certificate Management Service console. The NLB instance obtains and uses the certificate from the console.

CA certificate

The server uses the CA certificate to verify the signature of the client certificate. If the verification fails, the server rejects the connection.

A client certificate verifies a client's identity during communication with the server. You only need to install it on the client.

No

Yes

You can purchase a CA certificate in the Certificate Management Service console. The NLB instance obtains the certificate from the console.

If you need to support multiple domain names or use multiple server certificates, you can add additional certificates to the tcp/ssl listener after you create it. For more information, see Add an additional certificate.

On the Configure SSL Certificate page, select a certificate from the Server Certificate drop-down list.

If no server certificate is available, click Create SSL Certificate in the drop-down list to go to the Certificate Management Service console. In the console, you can purchase or upload a server certificate. For more information, see Purchase an official certificate and Upload an SSL certificate.
Select a TLS Security Policy. If you do not plan to Enable Mutual Authentication, click Next.

You can click Create TLS Security Policy in the drop-down list to create a custom tls security policy.
Optional: Turn on Enable Mutual Authentication. In the Default CA Certificate drop-down list, select a CA certificate.

If no CA certificate is available, click Purchase CA Certificate in the drop-down list to create a new certificate. For more information, see Purchase and enable a private CA.

You can later toggle Mutual Authentication in the SSL Certificate section on the details page of the tcp/ssl listener.

Step 3: Select server groups

On the Select Server Group page, configure the following parameters and click Next.

Parameter	Description
Server group type	Both server and IP types are supported.
Server group	Select a backend server group of the specified type.
Weight	Set the weight of the target server group. The larger the weight, the more requests the listener forwards to the server group. Valid values: 0 to 1000. Default value: 1000.
Add Server Group	Important Multiple server groups is a feature available only to allowlisted users. To use this feature, contact your account manager to apply for access. Click Add Server Group to add multiple server groups. After you add multiple server groups, the NLB instance distributes new connections based on the weight of each server group. You can add up to 5 server groups to a listener. When you use multiple server groups, at least one server group must have a weight greater than 0, and all server groups must use the same scheduling algorithm. Each server group is a minimum scheduling unit. Even if backend servers with the same IP address exist in different server groups, they are considered separate backends and receive traffic independently.

Important

The backend protocol for the server group must be TCP. After traffic passes through the NLB instance, the NLB instance terminates the SSL encryption. Backend servers no longer need to process SSL ciphertext.
You cannot associate a tcp/ssl listener with a server group that has Client IP Preservation enabled. Make sure that this feature is disabled for the server groups that you create.

Step 4: Configuration review

On the Configuration Review page, review the settings and click Submit.

Quickly create a TCP/SSL listener

In the left-side navigation pane, choose NLB > Instances.
On the Instances page, find the target instance and click its ID.

On the Listener tab, click Quick Create Listener. In the dialog box that appears, configure the following parameters and click OK.

Parameter	Description
Listener Protocol	Select a listener protocol. For this example, select TCPSSL.
Listener Port	Specify the listener port used to receive and forward requests to backend servers. You can click a commonly used port or enter a port number. The valid port range is 1 to 65535.
Server Certificate	Select a server certificate from the drop-down list. If no server certificate is available, click Create SSL Certificate to create a new certificate. For more information, see Purchase an official certificate.
TLS Security Policy	Select a tls security policy from the drop-down list. You can click Create TLS Security Policy in the drop-down list to create a custom tls security policy.
Server Group	Select a server group type and then select a corresponding backend server group. You can add multiple server groups and configure weights. For more information, see Step 3: Select server groups.

Server Load Balancer:Add a TCP/SSL listener