Does AWS Network Load Balancer decrypt packet in TLS termination mode?

Question

Architecture: client <-- TLS --> AWS Network Load Balancer port:443 <-- TLS --> backend server port:443

In the above architecture, TLS is terminated at the network load balancer (NLB).

1. Is TLS termination possible without decrypting packets?
2. If TLS is terminated on NLB, is there a new handshake between AWS NLB and the backend server?

Note that Backend server have its own SSL certificate different from one on the NLB.

Answer 1

TL;DR

1. No
2. Yes

NLB indeed has to decrypt the packets first and then re-encrypt before they are sent to the backend. And yes it does a new handshake with the server. NLB is kind of cheating because it spoofs the IP to look like it's the client talking to the backend directly. NLB looks transparent to the backend server.

However since you seem to be using HTTPS (guessing from port 443) you should use Application Load Balancer (ALB), not Network Load Balancer (NLB). NLB is meant for non-HTTP/non-HTTPS traffic, e.g. for DNS, SMTP, etc.

Hope that helps :)