--- title: TLS Routing Support for Teleport Behind an AWS... description: Explains how Teleport added TLS Routing support for Database Access when deployed behind an AWS Application Load Balancer (ALB). Since ALBs strip SNI and ALPN... canonical: https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: TLS Routing Support for Teleport Behind an AWS Application Load Balancer | daily.dev og:description: Explains how Teleport added TLS Routing support for Database Access when deployed behind an AWS Application Load Balancer (ALB). Since ALBs strip SNI and ALPN... og:url: https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z og:image: https://api.daily.dev/og/posts/AD1wPxS1z.png og:image:alt: TLS Routing Support for Teleport Behind an AWS Application Load Balancer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # TLS Routing Support for Teleport Behind an AWS Application Load Balancer **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary Explains how Teleport added TLS Routing support for Database Access when deployed behind an AWS Application Load Balancer (ALB). Since ALBs strip SNI and ALPN data during TLS handshake and don't support mTLS, Teleport uses a custom HTTP connection upgrade (similar to WebSockets) to tunnel the original TLS handshake through the ALB unmodified. It also details a detection mechanism using a custom ALPN string to determine if an ALB is present, avoiding unnecessary overhead. This capability, using the tsh proxy db command, ships starting in Teleport v10.2.4. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Teleport support TLS Routing for Database Access behind an AWS Application Load Balancer? Starting with Teleport v10.2.4, the tsh proxy db client command performs a custom HTTP connection upgrade (similar to a WebSocket upgrade but using a custom 'alpn' upgrade type) to tunnel the original TLS handshake through the ALB unmodified. This restores SNI, ALPN, and mutual TLS support that ALBs normally strip out during their own TLS termination. _daily.dev surfaces infrastructure deep dives like this for teams wiring TLS through AWS load balancers._ ### Why can't an AWS Application Load Balancer or Network Load Balancer terminate mutual TLS for a backend service like Teleport? AWS Network Load Balancer TLS listeners do not support mutual TLS and only allow http1.1 and h2 for ALPN, while both NLBs and ALBs strip SNI and ALPN values from the Client Hello during their own TLS handshake with backend targets and do not validate target certificates or server names. This loses the information a service like Teleport needs for TLS Routing. _Engineers comparing load balancer TLS limitations can track these infrastructure nuances on daily.dev._ ### How can I detect whether a client connection is passing through an AWS ALB before making a TLS connection? Perform a TLS handshake against the remote address requesting a custom, non-standard ALPN protocol string; if the server completes the handshake but returns an empty NegotiatedProtocol, an ALB (or similar proxy) is present and stripped the ALPN value, since a normal TLS endpoint would either negotiate the protocol or fail. This check only needs to run once per client session since ALB presence is stationary. _daily.dev helps engineers debugging proxy and load balancer TLS behavior stay current on real-world fixes._ ## Similar posts on daily.dev - [AWS Application and Network Load Balancers now support RFC 9151 compliant security policies](https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno) · AWS · 0 upvotes · 0 comments - [AWS Transfer Family now supports source IP preservation for SFTP servers behind a Network Load Balancer \(NLB\)](https://daily.dev/posts/aws-transfer-family-now-supports-source-ip-preservation-for-sftp-servers-behind-a-network-load-balan-qglvikp02) · AWS · 0 upvotes · 0 comments - [AWS ALBs Now Support Native URL and Host Header Rewriting](https://daily.dev/posts/aws-albs-now-support-native-url-and-host-header-rewriting-pcpzxll2q) · InfoQ · 0 upvotes · 0 comments - [Amazon RDS for PostgreSQL now supports post-quantum TLS key exchange](https://daily.dev/posts/amazon-rds-for-postgresql-now-supports-post-quantum-tls-key-exchange-ymuendp7r) · AWS · 1 upvotes · 0 comments - [AWS announces general availability of Policy-Based Routing on AWS Transit Gateway](https://daily.dev/posts/aws-announces-general-availability-of-policy-based-routing-on-aws-transit-gateway-kt1at86wt) · AWS · 0 upvotes · 0 comments --- Tags: [#aws](https://daily.dev/tags/aws), [#websocket](https://daily.dev/tags/websocket) [View this post on daily.dev](https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"TLS Routing Support for Teleport Behind an AWS Application Load Balancer","url":"https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z"},"datePublished":"2026-08-23T12:22:57.950Z","dateModified":"2026-08-23T12:52:52.085Z","description":"Explains how Teleport added TLS Routing support for Database Access when deployed behind an AWS Application Load Balancer (ALB). Since ALBs strip SNI and ALPN...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"aws,websocket","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"TLS Routing Support for Teleport Behind an AWS Application Load Balancer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tls-routing-support-for-teleport-behind-an-aws-application-load-balancer-ad1wpxs1z#faq","mainEntity":[{"@type":"Question","name":"How does Teleport support TLS Routing for Database Access behind an AWS Application Load Balancer?","acceptedAnswer":{"@type":"Answer","text":"Starting with Teleport v10.2.4, the tsh proxy db client command performs a custom HTTP connection upgrade (similar to a WebSocket upgrade but using a custom 'alpn' upgrade type) to tunnel the original TLS handshake through the ALB unmodified. This restores SNI, ALPN, and mutual TLS support that ALBs normally strip out during their own TLS termination. daily.dev surfaces infrastructure deep dives like this for teams wiring TLS through AWS load balancers."}},{"@type":"Question","name":"Why can't an AWS Application Load Balancer or Network Load Balancer terminate mutual TLS for a backend service like Teleport?","acceptedAnswer":{"@type":"Answer","text":"AWS Network Load Balancer TLS listeners do not support mutual TLS and only allow http1.1 and h2 for ALPN, while both NLBs and ALBs strip SNI and ALPN values from the Client Hello during their own TLS handshake with backend targets and do not validate target certificates or server names. This loses the information a service like Teleport needs for TLS Routing. Engineers comparing load balancer TLS limitations can track these infrastructure nuances on daily.dev."}},{"@type":"Question","name":"How can I detect whether a client connection is passing through an AWS ALB before making a TLS connection?","acceptedAnswer":{"@type":"Answer","text":"Perform a TLS handshake against the remote address requesting a custom, non-standard ALPN protocol string; if the server completes the handshake but returns an empty NegotiatedProtocol, an ALB (or similar proxy) is present and stripped the ALPN value, since a normal TLS endpoint would either negotiate the protocol or fail. This check only needs to run once per client session since ALB presence is stationary. daily.dev helps engineers debugging proxy and load balancer TLS behavior stay current on real-world fixes."}}]} ```