Using Forsta Plus with a Load Balancer with SSL Acceleration

When the 'SSLAuthorCertificate' config setting is enabled, Authoring logins will be redirected to SSL even if the 'EnforceSSLOnSite' is not - the former only allows SSL to be used - and enforces it for the entire session for all users. If the user reaches the server via HTTP, a redirect will occur to HTTPS for the login screen, and once authenticated, back to HTTP again. If reaching the server via HTTPS in the first place, the session will remain encrypted. This will also be the case if the user has 'Always use SSL' selected in the user settings, or if this is enforced on the company level as well.

The redirect happens on the server side, which will only work if the server itself decrypts the SSL traffic. If SSL traffic is handled by an external load balancer/SSL accelerator, two configuration settings have been added to support this mode in Forsta Plus: the SSLAcceleratorMode and SSLAcceleratorPort settings. In order to use these settings you can follow these steps:

1. Add a second listening port for HTTP in the IIS manager for the web site on which Authoring runs.

This can be any port except port 443 - Forsta Plus uses port 81 for our systems (so both ports 80 and 81 are listening for HTTP traffic.)

2. Configure your load balancer/SSL accelerator module to translate SSL requests and forward the decrypted transactions to the port you set up in step 1.
3. Set the SSLAcceleratorPort in the Forsta Plus settings to the port number you set up in step 1.
4. Enable the SSLAcceleratorMode setting.
5. Save.

Figure 1 - Using Forsta Plus with a load balancer