SSL/TLS & Certificate Management Flashcards

What is the role of an Intermediate CA certificate in the TLS certificate chain presented by a CDN edge?

Answer: It links the server's leaf certificate to the trusted Root CA, completing the chain of trust

Intermediate CA certificates form the bridge between an end-entity certificate and the root CA, allowing roots to remain offline while intermediates sign end-entity certs.

A CDN customer reports that some users see 'NET::ERR_CERT_AUTHORITY_INVALID'. What is the most likely cause?

Answer: The CDN is serving an incomplete certificate chain missing the intermediate CA

This browser error typically occurs when the server does not send the intermediate certificate, so the browser cannot build a complete trusted chain.

What does 'forward secrecy' guarantee in the context of CDN TLS sessions?

Answer: Compromise of the server's long-term private key does not expose past session data

Forward secrecy uses ephemeral session keys so that even if the server's private key is later stolen, recorded past sessions remain undecipherable.

Which HTTP response header should a CDN add to prevent browsers from downgrading an HTTPS connection to HTTP and include all subdomains?

Answer: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

The HSTS header with includeSubDomains and preload instructs browsers to always use HTTPS for the domain and its subdomains and enables preload list inclusion.

What is 'certificate transparency SCT' and why do CDNs need to ensure their certificates include them?

Answer: Signed Certificate Timestamps from CT logs proving the certificate was publicly logged, required by Chrome

SCTs are cryptographic proofs that a certificate has been submitted to a CT log; Chrome requires them for all publicly trusted certificates to prevent silent misissueance.

A CDN is deploying a new PoP in a region with strict data sovereignty laws. Which approach best addresses key management compliance?

Answer: Use a Hardware Security Module (HSM) local to that region to store and protect the private key

Regional HSMs keep private keys within the jurisdiction, satisfying data sovereignty requirements while still enabling local TLS termination.

What problem does 'TLS False Start' solve and what prerequisite must be met for a CDN to use it?

Answer: It allows the client to send application data before the handshake is complete, reducing latency; requires forward secrecy cipher suites

TLS False Start cuts one round trip by sending data after the ChangeCipherSpec but before the Finished message, and is only permitted when forward-secrecy ciphers are negotiated.