Proxy ssl handoff via mid-stream renegotiation

A traffic management device interposed between a client device and a plurality of server devices, comprising:

• a transceiver to send and receive data over a network;
• and
• a processor that is operative to perform actions comprising:
• obtaining a session key associated with an end-to-end encrypted session that is established between the client device and a first server device in the plurality of server devices;
• transmitting a renegotiation request to the client device over an end-to-end encrypted connection of the end-to-end encrypted session to request renegotiation of the end-to-end encrypted connection;
• intercepting a second set of handshake messages sent by the client device over the end-to-end encrypted connection, wherein the second set of handshake messages are addressed to the first server device, and wherein the second set of handshake messages are sent in response to the renegotiation request;
• decrypting the intercepted second set of handshake messages using one or more connection keys generated based on the session key;
• and
• redirecting the decrypted second set of handshake messages to a selected second server device of the plurality of server devices, such that the selected second server device replaces the first server device as an endpoint in the end-to-end encrypted connection.