CDN SSL/TLS & Certificate Management 2 — Questions and Answers
Question 1: What is the purpose of OCSP stapling in a CDN environment?
- To encrypt the certificate private key
- To allow the server to cache and serve certificate revocation status directly (Correct answer)
- To generate wildcard certificates automatically
- To distribute SSL sessions across PoPs
Correct answer: To allow the server to cache and serve certificate revocation status directly
OCSP stapling lets the server cache and attach the certificate revocation response to the TLS handshake, reducing latency and load on OCSP responders.
Question 2: Which TLS extension allows a CDN to serve multiple SSL certificates on a single IP address?
- OCSP stapling
- Certificate Transparency
- Server Name Indication (SNI) (Correct answer)
- HPKP
Correct answer: Server Name Indication (SNI)
SNI allows the client to send the requested hostname during the TLS handshake, enabling the server to select the correct certificate for that domain.
Question 3: What does 'certificate pinning' achieve in a CDN security context?
- Pins the certificate to a specific PoP location
- Forces clients to accept only a pre-approved certificate or public key (Correct answer)
- Automatically renews certificates before expiry
- Binds SSL sessions to client IP addresses
Correct answer: Forces clients to accept only a pre-approved certificate or public key
Certificate pinning instructs clients to reject any certificate not matching a pinned value, preventing MITM attacks using rogue certificates.
Question 4: A CDN operator needs to inspect encrypted HTTPS traffic for WAF purposes. Which technique makes this possible?
- Certificate Transparency logging
- TLS termination at the edge (Correct answer)
- DNSSEC validation
- HSTS preloading
Correct answer: TLS termination at the edge
TLS termination at the CDN edge decrypts traffic so the WAF can inspect it before re-encrypting and forwarding to the origin.
Question 5: What is the risk of using a wildcard certificate (*.example.com) across a CDN with many PoPs?
- Wildcard certs cannot be used with SNI
- Compromise of one PoP exposes the private key for all subdomains (Correct answer)
- Wildcard certs are not compatible with TLS 1.3
- They increase TTFB due to larger certificate size
Correct answer: Compromise of one PoP exposes the private key for all subdomains
A single wildcard private key stored across many PoPs means a breach at any single PoP compromises all subdomains covered by that certificate.
Question 6: Which certificate type provides the highest level of identity assurance for an e-commerce site served via CDN?
- Domain Validated (DV)
- Organization Validated (OV)
- Extended Validation (EV) (Correct answer)
- Wildcard DV
Correct answer: Extended Validation (EV)
EV certificates require rigorous identity verification of the organization and historically triggered a green address bar, providing the highest assurance level.
Question 7: What happens during a TLS session resumption using session tickets in a CDN with multiple edge nodes?
- The client must perform a full handshake at each new PoP
- The session ticket encrypted with a shared key allows resumption at any PoP holding that key (Correct answer)
- Session tickets are only valid on the originating PoP
- Session resumption is disabled when SNI is active
Correct answer: The session ticket encrypted with a shared key allows resumption at any PoP holding that key
Session tickets encrypt session state with a server-held key; if CDN PoPs share that key, clients can resume sessions at any participating node.
CDN SSL/TLS & Certificate Management 2
What is the purpose of OCSP stapling in a CDN environment?