TLS, HTTPS и управление сертификатами в CDN

Modern CDNs terminate TLS at the edge, meaning the encrypted HTTPS handshake completes at the nearby PoP rather than at your distant origin.

• Shorter handshake round trips equals faster secure connections
• Offloads CPU-heavy crypto from your origin
• Enables edge-level features like HTTP/2 and 0-RTT

A TLS handshake negotiates encryption keys before any data flows. It costs round trips, so doing it at a nearby edge is far faster than at a remote origin. Session resumption can skip steps on repeat visits.

CDNs typically offer managed certificates issued and auto-renewed for you (often via an ACME-based authority), or let you upload your own certificate and private key.

• Managed: zero-touch renewal, less risk of expiry outages
• Custom: needed for EV certs or specific compliance

Server Name Indication (SNI) lets one edge IP serve many domains, each with its own certificate. The client sends the hostname during the handshake so the edge picks the right cert.

When uploading a custom cert, you provide the full chain and the private key. Always include intermediates so clients can build the trust path.

You should force every request to HTTPS. Configure the CDN to redirect http:// to https:// so no plaintext traffic is ever served.

• Set the viewer protocol policy to redirect-to-https
• Combine with HSTS for stronger guarantees

HSTS tells browsers to always use HTTPS for your domain for a set duration, preventing downgrade attacks.

Terminating TLS at the edge lets the CDN speak modern protocols to the browser even if your origin only supports HTTP/1.1.

• HTTP/2: multiplexing over one connection
• HTTP/3 (QUIC): runs over UDP, faster on lossy networks

Edge-to-origin traffic should also be encrypted. Configure the CDN to connect to your origin over HTTPS and, ideally, validate the origin certificate to prevent man-in-the-middle attacks on the back end.

An expired certificate causes a full outage. Even with managed renewal, monitor expiry dates and renewal events. Alert well before the expiry window.

Disable legacy protocols (TLS 1.0/1.1) and weak ciphers. Most CDNs offer security policy presets that allow only TLS 1.2+ with strong ciphers, balancing security and compatibility.

You learned how CDNs handle HTTPS: terminating TLS at the edge for speed, provisioning managed or custom certificates with SNI, enforcing HTTPS and HSTS, enabling HTTP/2 and HTTP/3, and securing the origin connection while monitoring certificate expiry.