There are many HTTPS-servers (Nginx or Haproxy or something else?):
- single balancer,
- and multiple workers.
Is it possible to migrate an established HTTPS session (with HTTP request headers already received) from balancer to worker?
- Balancer should completely forget about this session.
- Worker should receive the rest of HTTP request body and send HTTP response directly to client over SSL (omitting balancer).
This seems relatively trivial for plain HTTP because it's unencrypted, but seems a bit difficult for HTTPS because session-specific SSL handshake params should be (transparently for client):
- Serialized by balancer,
- Transferred to worker,
- Deserialized by worker,
- Applied by worker.
The nearest feature I've found is named "SSL connection mirroring" and is the part of F5 BIG-IP platform. It demonstrates that described problem is practically solvable. But it's (a) proprietary, (b) extremely high-priced and (c) failover-only solution, i.e. HA without LB.
0 Answers