Best Recommendation for level where to terminate the TLS.

[chandreshreddyg17]

Hello All,
I have deployed APISIX gateway in decouple mode. I have one control plane to manage the admin api and two data plane to mange the client traffic and a Load Balancer to distribute client traffic to data planes. ETCD cluster to store the data. I need the requests in https so the data must be stayed in encrypted. I want to terminate the tls where I place the certs and keys.
So I am thinking to terminate tls at the Load Balancer level or data plane (gateway) level (storing certs and keys in etcd so all the data plane shares the same).

@dosu

[dosubot[bot]]

Both options are valid — here's a breakdown to help you decide:

Option A: Terminate TLS at the Load Balancer

• Offloads the computationally expensive TLS handshakes from your APISIX data planes [1]
• Simpler certificate management — you only manage certs on the LB
• Traffic between the LB and APISIX data planes would be unencrypted (unless you add a second layer of TLS)

Option B: Terminate TLS at the APISIX Data Plane (recommended for your use case)

Since you explicitly need data to stay encrypted end-to-end and you're already running in decoupled mode with etcd, this is the stronger fit:

• SSL certificates are stored in etcd under /ssls and automatically synchronized to all data plane nodes in real-time via etcd's watch mechanism [2]. This means both your data planes will share the same certs without manual distribution.
• Certificate updates propagate to all DPs without dropping active connections or requiring a reload — this is called "hitless rotation" [3].
• APISIX uses SNI-based matching to select the correct certificate during the TLS handshake [4], so you can manage multiple domains from a single deployment.
• You get visibility into TLS connection details at the gateway level, which enables fine-grained security policies and mTLS if needed.
• You can also reference secrets from external managers using $secret:// or $env:// prefixes instead of storing raw keys in etcd [5].

Hybrid option (also common): Use a TCP/L4 load balancer with TLS passthrough to distribute traffic to your APISIX data planes, which then perform the actual TLS termination [6]. This gives you both HA load distribution and end-to-end encryption. One caveat: you may need Proxy Protocol v2 on the LB to preserve client IPs, and there's a known quirk where X-Forwarded-Port may reflect the internal APISIX port rather than 443 [6].

My recommendation: Given your requirement that data must stay encrypted and you already have etcd in place, terminate TLS at the APISIX data plane level with a TCP passthrough load balancer in front. This ensures encryption all the way to the gateway while still leveraging your LB for traffic distribution and health checks. Store certs via the Admin API (control plane) and etcd will handle synchronization to both data planes automatically.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.