CDN SSL/TLS & Certificate Management 3 — Questions and Answers
Question 1: What is the function of Certificate Transparency (CT) logs in the context of CDN certificate management?
- They store encrypted copies of private keys
- They provide a public, auditable record of all issued certificates (Correct answer)
- They automatically revoke misissued certificates
- They cache CRL responses for CDN edge nodes
Correct answer: They provide a public, auditable record of all issued certificates
CT logs are append-only public ledgers that record every certificate issued by a CA, allowing domain owners and browsers to detect unauthorized certificates.
Question 2: Which protocol is ACME (Automatic Certificate Management Environment) most commonly associated with?
- DigiCert Enterprise API
- Let's Encrypt certificate issuance automation (Correct answer)
- Microsoft Active Directory Certificate Services
- Symantec Managed PKI
Correct answer: Let's Encrypt certificate issuance automation
ACME is the protocol developed alongside Let's Encrypt to automate DV certificate issuance, renewal, and revocation.
Question 3: A CDN notices that the cipher suite TLS_RSA_WITH_AES_128_CBC_SHA is still negotiated by some clients. What is the primary concern?
- It does not support SNI
- It lacks forward secrecy because RSA key exchange is used (Correct answer)
- It is incompatible with HTTP/2
- It requires an EV certificate
Correct answer: It lacks forward secrecy because RSA key exchange is used
RSA key exchange does not provide forward secrecy; if the server's private key is later compromised, all past recorded sessions can be decrypted.
Question 4: What does HSTS (HTTP Strict Transport Security) instruct a browser to do?
- Cache the TLS certificate locally
- Always connect to the domain over HTTPS, even if the user types HTTP (Correct answer)
- Pin the server's public key for future connections
- Block HTTP/2 fallback to HTTP/1.1
Correct answer: Always connect to the domain over HTTPS, even if the user types HTTP
HSTS tells the browser to reject plain HTTP connections and always use HTTPS for the specified domain and duration.
Question 5: When a CDN performs SSL bridging (re-encryption) to the origin, what is the key security requirement?
- The origin must use a self-signed certificate
- The CDN must validate the origin's certificate to prevent MITM between edge and origin (Correct answer)
- The CDN must use TLS 1.0 for backward compatibility
- The origin connection must use the same session ticket as the client
Correct answer: The CDN must validate the origin's certificate to prevent MITM between edge and origin
Without validating the origin's certificate, the CDN-to-origin connection is vulnerable to man-in-the-middle attacks even though the client-to-CDN leg is secure.
Question 6: What is a SAN (Subject Alternative Name) certificate and why is it preferred in CDN deployments?
- A certificate that supports only a single domain for security isolation
- A certificate that lists multiple domain names, allowing one cert to cover many CDN customer domains (Correct answer)
- A certificate pinned to a specific server's serial number
- A certificate issued only for CDN origin servers
Correct answer: A certificate that lists multiple domain names, allowing one cert to cover many CDN customer domains
SAN certificates embed multiple domain names in one certificate, reducing the number of certificates a CDN must manage across its shared infrastructure.
Question 7: Which TLS 1.3 feature reduces connection setup latency compared to TLS 1.2?
- Mandatory certificate pinning
- 0-RTT (Zero Round Trip Time) resumption (Correct answer)
- Larger RSA key sizes
- Elimination of SNI support
Correct answer: 0-RTT (Zero Round Trip Time) resumption
TLS 1.3's 0-RTT allows clients to send application data in the first message when resuming a previous session, eliminating one round trip.
CDN SSL/TLS & Certificate Management 3
What is the function of Certificate Transparency (CT) logs in the context of CDN certificate management?