CDN SSL/TLS & Certificate Management 5 — Questions and Answers
Question 1: What is the role of an Intermediate CA certificate in the TLS certificate chain presented by a CDN edge?
- It encrypts the server's private key at rest
- It links the server's leaf certificate to the trusted Root CA, completing the chain of trust (Correct answer)
- It provides the session ticket encryption key
- It stores the OCSP response for the leaf certificate
Correct answer: It links the server's leaf certificate to the trusted Root CA, completing the chain of trust
Intermediate CA certificates form the bridge between an end-entity certificate and the root CA, allowing roots to remain offline while intermediates sign end-entity certs.
Question 2: A CDN customer reports that some users see 'NET::ERR_CERT_AUTHORITY_INVALID'. What is the most likely cause?
- The certificate uses SHA-256 which is unsupported by older clients
- The CDN is serving an incomplete certificate chain missing the intermediate CA (Correct answer)
- The domain's CNAME record points to the wrong CDN PoP
- The origin is returning a 301 redirect over HTTPS
Correct answer: The CDN is serving an incomplete certificate chain missing the intermediate CA
This browser error typically occurs when the server does not send the intermediate certificate, so the browser cannot build a complete trusted chain.
Question 3: What does 'forward secrecy' guarantee in the context of CDN TLS sessions?
- Future certificates are automatically trusted by current clients
- Compromise of the server's long-term private key does not expose past session data (Correct answer)
- Encrypted content is cached forward to the next PoP without re-encryption
- Session keys are shared with the origin for log auditing
Correct answer: Compromise of the server's long-term private key does not expose past session data
Forward secrecy uses ephemeral session keys so that even if the server's private key is later stolen, recorded past sessions remain undecipherable.
Question 4: Which HTTP response header should a CDN add to prevent browsers from downgrading an HTTPS connection to HTTP and include all subdomains?
- Content-Security-Policy: upgrade-insecure-requests
- Strict-Transport-Security: max-age=31536000; includeSubDomains; preload (Correct answer)
- X-Frame-Options: DENY
- X-Content-Type-Options: nosniff
Correct answer: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
The HSTS header with includeSubDomains and preload instructs browsers to always use HTTPS for the domain and its subdomains and enables preload list inclusion.
Question 5: What is 'certificate transparency SCT' and why do CDNs need to ensure their certificates include them?
- Session Continuation Tokens that enable TLS resumption across PoPs
- Signed Certificate Timestamps from CT logs proving the certificate was publicly logged, required by Chrome (Correct answer)
- Secure Channel Tokens that authenticate CDN edge nodes to origin
- Symmetric Cipher Tags embedded in the certificate for cipher negotiation
Correct answer: Signed Certificate Timestamps from CT logs proving the certificate was publicly logged, required by Chrome
SCTs are cryptographic proofs that a certificate has been submitted to a CT log; Chrome requires them for all publicly trusted certificates to prevent silent misissueance.
Question 6: A CDN is deploying a new PoP in a region with strict data sovereignty laws. Which approach best addresses key management compliance?
- Use a shared global wildcard certificate stored in all PoPs equally
- Use a Hardware Security Module (HSM) local to that region to store and protect the private key (Correct answer)
- Disable TLS termination at that PoP and pass traffic to a central termination point
- Issue a separate DV certificate daily using ACME to minimize key exposure window
Correct answer: Use a Hardware Security Module (HSM) local to that region to store and protect the private key
Regional HSMs keep private keys within the jurisdiction, satisfying data sovereignty requirements while still enabling local TLS termination.
Question 7: What problem does 'TLS False Start' solve and what prerequisite must be met for a CDN to use it?
- It prevents certificate replay attacks; requires certificate pinning
- It allows the client to send application data before the handshake is complete, reducing latency; requires forward secrecy cipher suites (Correct answer)
- It starts a new TLS session without a ClientHello; requires session tickets
- It bypasses SNI for legacy clients; requires a dedicated IP per certificate
Correct answer: It allows the client to send application data before the handshake is complete, reducing latency; requires forward secrecy cipher suites
TLS False Start cuts one round trip by sending data after the ChangeCipherSpec but before the Finished message, and is only permitted when forward-secrecy ciphers are negotiated.
CDN SSL/TLS & Certificate Management 5
What is the role of an Intermediate CA certificate in the TLS certificate chain presented by a CDN edge?