CDN SSL/TLS & Certificate Management 4 — Questions and Answers
Question 1: A certificate has expired on a CDN edge node serving 50 PoPs. What is the most scalable remediation approach?
- Manually upload the new certificate to each PoP via SSH
- Push the renewed certificate through the CDN's centralized certificate management API (Correct answer)
- Enable HTTP fallback until the certificate is replaced
- Request a new IP address for each affected PoP
Correct answer: Push the renewed certificate through the CDN's centralized certificate management API
Centralized certificate management APIs propagate updated certificates to all PoPs simultaneously, making renewal scalable across large CDN networks.
Question 2: What is the purpose of a Certificate Revocation List (CRL) and what is its main drawback for CDN use?
- It encrypts certificates in transit; drawback is high CPU cost
- It lists revoked certificates; drawback is large file size and staleness causing latency (Correct answer)
- It stores session tickets; drawback is requiring shared state
- It signs certificates; drawback is single point of failure
Correct answer: It lists revoked certificates; drawback is large file size and staleness causing latency
CRLs list all revoked certificates from a CA, but they can grow very large and are updated infrequently, making real-time revocation checking unreliable.
Question 3: Which Diffie-Hellman variant is recommended for forward secrecy in modern CDN TLS configurations?
- Static DH (DHE with fixed parameters)
- Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) (Correct answer)
- RSA key encapsulation
- DSA-based key exchange
Correct answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
ECDHE provides forward secrecy using ephemeral keys and is preferred because elliptic curve math offers strong security with smaller key sizes and better performance.
Question 4: A customer's domain uses CAA (Certification Authority Authorization) DNS records. What do these records control?
- Which CDN providers are allowed to cache the domain's content
- Which Certificate Authorities are permitted to issue certificates for the domain (Correct answer)
- The maximum TTL for SSL session caches
- The allowed cipher suites for TLS negotiation
Correct answer: Which Certificate Authorities are permitted to issue certificates for the domain
CAA records let domain owners specify which CAs may issue certificates for their domain, preventing unauthorized certificate issuance.
Question 5: What is the difference between 'TLS offloading' and 'TLS passthrough' in CDN architecture?
- Offloading caches TLS sessions; passthrough skips caching entirely
- Offloading terminates TLS at the CDN edge; passthrough forwards encrypted traffic directly to origin (Correct answer)
- Offloading uses TLS 1.2; passthrough uses TLS 1.3
- Offloading requires EV certificates; passthrough works with DV certificates
Correct answer: Offloading terminates TLS at the CDN edge; passthrough forwards encrypted traffic directly to origin
TLS offloading decrypts traffic at the edge (enabling caching and WAF inspection), while passthrough forwards the encrypted stream unmodified to the origin.
Question 6: Why might a CDN enforce a minimum TLS version of 1.2 and deprecate TLS 1.0 and 1.1?
- TLS 1.0/1.1 use larger key sizes that slow down edge nodes
- TLS 1.0/1.1 have known vulnerabilities (POODLE, BEAST) and lack modern cipher support (Correct answer)
- TLS 1.0/1.1 are incompatible with wildcard certificates
- TLS 1.0/1.1 do not support HTTP/2 multiplexing
Correct answer: TLS 1.0/1.1 have known vulnerabilities (POODLE, BEAST) and lack modern cipher support
TLS 1.0 and 1.1 are vulnerable to attacks like POODLE and BEAST and do not support modern AEAD cipher suites, making them insecure for production use.
Question 7: What is 'mutual TLS' (mTLS) and in what CDN scenario is it most commonly applied?
- A configuration where two CDN PoPs share the same certificate
- A handshake where both client and server present certificates for authentication (Correct answer)
- A method of distributing TLS load across multiple edge servers
- A technique for compressing TLS handshake messages
Correct answer: A handshake where both client and server present certificates for authentication
mTLS requires both parties to authenticate with certificates, commonly used to secure CDN-to-origin connections or in zero-trust API gateway scenarios.
CDN SSL/TLS & Certificate Management 4
A certificate has expired on a CDN edge node serving 50 PoPs.
What is the most scalable remediation approach?