All Products
Search

This Product

    Server Load Balancer:Use Network Load Balancer for TCPSSL offloading (one-way authentication)

    Document Center

    Server Load Balancer:Use Network Load Balancer for TCPSSL offloading (one-way authentication)

    Last Updated:Aug 19, 2026

    For Layer 4 applications with high security requirements, configuring SSL certificates on each backend server is inefficient. To improve performance, use the TCPSSL offloading feature of Network Load Balancer (NLB). Deploy an NLB instance at your traffic ingress and configure an SSL certificate on it. The NLB instance then handles all decryption, receiving encrypted traffic through a TCPSSL listener and forwarding plaintext traffic to your backend servers.

    Prerequisites

    • An NLB instance is created. For more information, see Create and manage an NLB instance.

    • An NLB server group is created. For more information, see NLB server groups.

      Important

      • The server group must use the TCP protocol. The NLB instance handles SSL decryption, so backend servers receive plaintext traffic.

      • A TCPSSL listener cannot be associated with a server group for which client IP preservation is enabled. Make sure that this feature is disabled for the server group that you create.

    • The server group contains ECS instances ECS01 and ECS02, on which application services are deployed.

    Step 1: Prepare a server certificate

    You can purchase a server certificate from Alibaba Cloud, or purchase one from a third-party provider and upload it.

    This topic uses a server certificate purchased from Alibaba Cloud as an example.

    Note

    When you purchase an SSL certificate, you must bind it to a domain name. Make sure that you have registered a domain name and completed its ICP filing. For more information, see Register a domain name on Alibaba Cloud and ICP filing application overview.

    Step 2: Configure a TCPSSL listener

    1. Log on to the Network Load Balancer console.

    2. In the left-side navigation pane, choose NLB > Instances.

    3. In the top navigation bar, select the region where the instance is deployed.

    4. On the Instances page, find the target instance and click Create Listener in the Actions column.

    5. On the Configure Listener page, set the following parameters and click Next. You can leave other parameters at their default values.

      Parameter

      Description

      Listener Protocol

      Select TCPSSL.

      Listener Port

      This topic uses port 443.

    6. On the Configure SSL Certificate page, configure the following parameters. You can keep other parameters at their default values or modify them as needed. Then, click Next.

      Parameter

      Description

      Server Certificate

      Select the server certificate that you prepared in Step 1.

      TLS Security Policies

      Select a policy based on your security requirements. If you select a higher TLS version, make sure that it is compatible with your clients.

    7. On the Select Server Group page, configure the following parameter. You can keep other parameters at their default values or modify them as needed. Then, click Next.

      Parameter

      Description

      Select Server Group

      Select the server group that you created.

    8. On the Configuration Review page, verify the parameters and click Submit. Wait for the listener to be created.

    Step 3: Configure DNS resolution

    Use CNAME records to map your custom domain name to the NLB instance domain name.

    1. In the left-side navigation pane, choose NLB > Instances.

    2. On the Instances page, copy the domain name of the NLB instance that you want to manage.

    3. Perform the following steps to create a CNAME record:

      Note

      If your domain name is not registered through Alibaba Cloud Domains, add it to Alibaba Cloud DNS first. For more information, see Manage domain names. Skip this step for domains registered through Alibaba Cloud Domains.

      1. Log on to the Alibaba Cloud DNS console.

      2. On the Authoritative DNS Resolution page, find your domain name and click DNS Settings in the Actions column.

      3. On the DNS Settings tab of the domain name details page, click Add DNS Record.

      4. In the Add Record panel, configure the parameters and click OK. The following table describes the parameters.

        Parameter

        Description

        Record Type

        Select CNAME from the drop-down list.

        Hostname

        Domain name prefix. @ is used in this example.

        Note

        If the domain name is a root domain name, enter @.

        DNS Query Source

        Select Default.

        Record Value

        Enter the CNAME, which is the domain name of the NLB instance.

        TTL Period

        TTL value for DNS caching. The default is used in this example.

    Step 4: Test the connection

    In a web browser, enter the domain name that is mapped to the NLB instance and refresh the page several times. The NLB instance sends requests over HTTPS to the backend service and distributes them between the two ECS instances.

    Important

    Due to browser caching, we recommend that you use a private or incognito window to access the domain name when you test the Layer 4 load balancer.

    If the page displays Hello World ! This is ECS01., ECS01 processed the request. If it displays Hello World ! This is ECS02., the request was forwarded to ECS02.

    Related documentation