Wan optimization for encrypted data traffic

A non-transitory machine readable medium storing a program for execution by a set of processing units, the program for a gateway router deployed to a public cloud to provide WAN (wide area network) optimization for a WAN that connects at least two sites, the method comprising:

• receiving an encrypted data stream originating from a source device located at a first site connected by the WAN and destined for a destination device located at a second site connected by the WAN, the encrypted data stream comprising ciphertext content generated from plaintext content that the source device sends to the destination device, the ciphertext content comprising a plurality of encrypted segments;
• without decrypting the encrypted data stream, performing a set of WAN optimization operations on the encrypted data stream to produce a WAN-optimized encrypted data stream, the set of WAN optimization operations comprising at least (i) a traffic redundancy elimination (TRE) first operation for identifying redundant segments in the plurality of encrypted segments comprising the encrypted data stream and replacing the identified redundant segments with segment identifiers corresponding to the redundant segments and (ii) a compression second operation for compressing the encrypted data stream and producing the WAN-optimized encrypted data stream;
• and
• forwarding the WAN-optimized encrypted data stream to the destination device at the second site.