0Pricing
Caching Strategies: Redis + CDN + Edge Computing · 课时

CDN 上的 TLS、HTTPS 与证书管理

了解 CDN 如何在边缘终止 TLS、管理证书，并启用 HTTP/2 和 HSTS 等现代安全传输功能。

CDN 上的 TLS、HTTPS 与证书管理 是 CoddyKit 上的免费 Caching Strategies: Redis + CDN + Edge Computing 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Caching Strategies: Redis + CDN + Edge Computing 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Caching Strategies: Redis + CDN + Edge Computing 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Why TLS at the Edge

Modern CDNs terminate TLS at the edge, meaning the encrypted HTTPS handshake completes at the nearby PoP rather than at your distant origin.

  • Shorter handshake round trips equals faster secure connections
  • Offloads CPU-heavy crypto from your origin
  • Enables edge-level features like HTTP/2 and 0-RTT

The TLS Handshake Briefly

A TLS handshake negotiates encryption keys before any data flows. It costs round trips, so doing it at a nearby edge is far faster than at a remote origin. Session resumption can skip steps on repeat visits.

Certificate Provisioning

CDNs typically offer managed certificates issued and auto-renewed for you (often via an ACME-based authority), or let you upload your own certificate and private key.

  • Managed: zero-touch renewal, less risk of expiry outages
  • Custom: needed for EV certs or specific compliance

SNI and Shared Certificates

Server Name Indication (SNI) lets one edge IP serve many domains, each with its own certificate. The client sends the hostname during the handshake so the edge picks the right cert.

Configuring a Custom Certificate

When uploading a custom cert, you provide the full chain and the private key. Always include intermediates so clients can build the trust path.

aws cloudfront update-distribution \
  --id E123ABC \
  --viewer-certificate ACMCertificateArn=arn:aws:acm:us-east-1:...:certificate/abc,SSLSupportMethod=sni-only

Enforcing HTTPS Redirects

You should force every request to HTTPS. Configure the CDN to redirect http:// to https:// so no plaintext traffic is ever served.

  • Set the viewer protocol policy to redirect-to-https
  • Combine with HSTS for stronger guarantees

HTTP Strict Transport Security (HSTS)

HSTS tells browsers to always use HTTPS for your domain for a set duration, preventing downgrade attacks.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

Modern Protocols: HTTP/2 and HTTP/3

Terminating TLS at the edge lets the CDN speak modern protocols to the browser even if your origin only supports HTTP/1.1.

  • HTTP/2: multiplexing over one connection
  • HTTP/3 (QUIC): runs over UDP, faster on lossy networks

Origin Encryption

Edge-to-origin traffic should also be encrypted. Configure the CDN to connect to your origin over HTTPS and, ideally, validate the origin certificate to prevent man-in-the-middle attacks on the back end.

Certificate Expiry Monitoring

An expired certificate causes a full outage. Even with managed renewal, monitor expiry dates and renewal events. Alert well before the expiry window.

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate

Cipher Suites and TLS Versions

Disable legacy protocols (TLS 1.0/1.1) and weak ciphers. Most CDNs offer security policy presets that allow only TLS 1.2+ with strong ciphers, balancing security and compatibility.

Quick Check

Check your understanding of TLS on the CDN.

Recap

You learned how CDNs handle HTTPS: terminating TLS at the edge for speed, provisioning managed or custom certificates with SNI, enforcing HTTPS and HSTS, enabling HTTP/2 and HTTP/3, and securing the origin connection while monitoring certificate expiry.

常见问题解答

「CDN 上的 TLS、HTTPS 与证书管理」课时是免费的吗？

是的 — 「CDN 上的 TLS、HTTPS 与证书管理」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Caching Strategies: Redis + CDN + Edge Computing 课程的其余内容，请升级到 CoddyKit PRO。 Caching Strategies: Redis + CDN + Edge Computing 课程共包含 4 节课。

「CDN 上的 TLS、HTTPS 与证书管理」这节课中我会学到什么？

了解 CDN 如何在边缘终止 TLS、管理证书，并启用 HTTP/2 和 HSTS 等现代安全传输功能。 你通过在浏览器中直接运行的动手代码来练习 Caching Strategies: Redis + CDN + Edge Computing，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 Caching Strategies: Redis + CDN + Edge Computing 需要有经验吗？

无需任何先前经验。CoddyKit 上的 Caching Strategies: Redis + CDN + Edge Computing 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。

「CDN 上的 TLS、HTTPS 与证书管理」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 Caching Strategies: Redis + CDN + Edge Computing 课中编写并运行代码吗？

能。每节 Caching Strategies: Redis + CDN + Edge Computing 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. CDN 缓存控制标头
  2. CDN 安全功能
  3. 衡量 CDN 性能
  4. CDN 上的 TLS、HTTPS 与证书管理
← 返回 Caching Strategies: Redis + CDN + Edge Computing