Where to terminate TLS
Somewhere in the path between a client and your application, the encrypted stream has to become plaintext. The only question is where, and every answer moves both convenience and exposure.
At the edge
Terminating at a load balancer or reverse proxy centralises certificate handling, makes inspection and routing easy, and keeps the application simple. The cost is that everything behind the proxy carries plaintext, which means the internal network is trusted. In a flat network, that is a large assumption.
At the service
Terminating inside each service keeps plaintext off the wire entirely and makes the trust boundary smaller. The cost is operational: every service now manages certificates and reloads, and the edge can no longer route on content, only on connection metadata.
End to end
Encrypting to the final destination is the strongest option and the hardest to operate. Key distribution, rotation and revocation become part of every deployment, and debugging a failed handshake is no longer a matter of reading one log.
Choosing
- Terminate at the edge when the internal network is genuinely trusted and the operational simplicity is worth more than the internal exposure.
- Terminate at the service when the internal path crosses trust boundaries you do not control.
- Encrypt end to end when the data's sensitivity justifies the operational cost, and be honest about whether you can actually run the rotation.
There is no universally right answer, but there is a wrong one: leaving the decision implicit, so that the answer depends on whoever set up the last proxy.