TLS termination is the point in a network path where an encrypted TLS connection is decrypted so the receiving proxy, load balancer, or application can inspect and process the traffic. After termination, the device may forward the request to an internal service over plain HTTP or re-encrypt it to the backend. This is common in reverse proxies, CDNs, and edge caches because it centralizes certificate handling and reduces work for origin servers.
It matters in cyber security because the termination point sees sensitive data in cleartext and becomes a high-value target. If it is misconfigured or vulnerable, attackers may steal credentials, inject requests, or bypass security controls that depend on inspecting traffic. Defenders use TLS termination to enforce certificate policy, log requests, apply filtering, and support web application firewalls, but they must protect keys, restrict access, and patch the proxy quickly. In practice, many attacks focus on edge systems because compromising TLS termination can expose every session that passes through it.