CDN SSL/TLS & Certificate Management 5

Question 1

What is the role of an Intermediate CA certificate in the TLS certificate chain presented by a CDN edge?

Accepted Answer

It links the server's leaf certificate to the trusted Root CA, completing the chain of trust

Answer

Intermediate CA certificates form the bridge between an end-entity certificate and the root CA, allowing roots to remain offline while intermediates sign end-entity certs.

Question 2

A CDN customer reports that some users see 'NET::ERR_CERT_AUTHORITY_INVALID'. What is the most likely cause?

Accepted Answer

The CDN is serving an incomplete certificate chain missing the intermediate CA

Answer

This browser error typically occurs when the server does not send the intermediate certificate, so the browser cannot build a complete trusted chain.

Question 3

What does 'forward secrecy' guarantee in the context of CDN TLS sessions?

Accepted Answer

Compromise of the server's long-term private key does not expose past session data

Answer

Forward secrecy uses ephemeral session keys so that even if the server's private key is later stolen, recorded past sessions remain undecipherable.

Question 4

Which HTTP response header should a CDN add to prevent browsers from downgrading an HTTPS connection to HTTP and include all subdomains?

Accepted Answer

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Answer

The HSTS header with includeSubDomains and preload instructs browsers to always use HTTPS for the domain and its subdomains and enables preload list inclusion.

Question 5

What is 'certificate transparency SCT' and why do CDNs need to ensure their certificates include them?

Accepted Answer

Signed Certificate Timestamps from CT logs proving the certificate was publicly logged, required by Chrome

Answer

SCTs are cryptographic proofs that a certificate has been submitted to a CT log; Chrome requires them for all publicly trusted certificates to prevent silent misissueance.

(CDN) Content Delivery Network Certification Practice Test

(CDN) Content Delivery Network Certification Practice Test

CDN SSL/TLS & Certificate Management 5