Help & Documentation>Cloud Load Balance>Operation Guide>CLB listener>Configuring TCP SSL Listener

Configuring TCP SSL Listener

Last updated: 2026-06-08 10:45:42

On this page:

You can create a TCP SSL listener for a Cloud Load Balancer (CLB) instance to forward encrypted TCP requests from the client. TCP SSL is applicable to scenarios where ultra-high performance and large-scale TLS offloading are required. Real servers bound to the TCP SSL listener can directly obtain the real client IP address.
Note:
TCP SSL listener is currently supported only for CLB but not classic CLB.

Scenarios

TCP SSL is suitable for scenarios that have high requirements for security when the TCP protocol is used:
TCP SSL listeners support configuration of certificates to block unauthorized access.
Unified certificate management is supported for CLB to implement decryption.
One-way authentication and mutual authentication are supported.
A real server can directly obtain the client IP address.

Preparations

Instructions

Step 1. Configure a listener

1. Log in to the Cloud Load Balancer console and click Instance management in the left sidebar.
2. Select the region from the top left corner of the CLB instance list page, and click Configure Listener in the operation column on the right side of the instance list.
3. Under TCP/UDP/TCP SSL/QUIC listeners, click Create and configure the TCP SSL listener in the Create Listener dialog box that appears.
3.1 Basic Configuration
Configuration Item
Note
Sample
Name
Listener name.
test-tcpssl-9000    
Listener Protocol and Ports
Listening protocol: In this case, select TCP SSL.
Listening port: The port used to receive requests and forward them to the real server. The port number ranges from 1 to 65535.
The listening port must be unique in the same CLB instance.
TCP SSL:9000
SSL parsing method
One-way authentication and mutual authentication are supported.
One-Way authentication
Server Certificate
You can select an existing certificate in the SSL Certificate Service console or create a new certificate.
Existing certificate
Balancing Method
CLB supports two scheduling algorithms for TCP SSL listeners: weighted round robin (WRR) and weighted least connections (WLC).
Weighted Round Robin (WRR) Algorithm: Requests are distributed to backend servers in sequence based on their weights. This algorithm performs scheduling based on the number of new connections. Servers with higher weights have a higher probability of being polled, and servers with the same weight process the same number of connections.
WLC: Loads of servers are estimated based on the number of active connections to the servers. This algorithm performs scheduling based on server loads and weights. For servers with the same weight, those have less loads are more likely to be scheduled.
WRR
3.2 Health check
For more information on health checks, see TCP SSL Health Check.
3.3 Session persistence (not supported currently)
TCP SSL listeners don't support session persistence currently.

Step 2. Bind a backend server

1. On the Listener Management page, click the created listener TCP SSL:9000 to view the bound real servers on the right of the listener.
2. Click Bind, select the target real server, and configure the server port and weight in the pop-up window.
Note:
Default port: If you select the "Default Port" first and then select the real servers, all real servers use the default port.

Step 3. Configure a security group (optional)

You need to configure a CLB security group to isolate public network traffic. For more information, see Configuring CLB Security Group.

Step 4. Modify or delete a listener (optional)

If you need to modify or delete an existing listener, navigate to the "Listener Management" page, select the completed listener, and click on the

icon to modify or the

icon to delete.
中国站 - English