3 ms·
The CDN's servers provide the encryption, so it would make sense that the certificate is in their name. You can't do the encryption on the origin server, becaus
by shawnz 12y ago
The CDN's servers provide the encryption, so it would make sense that the certificate is in their name. You can't do the encryption on the origin server, because the CDN needs access to the data to be able to cache it.
- wslh 12y agoBut it completely breaks the certificate meaning. Imagine the bad guy giving you a fake certificate called: cdn.badguy.com and explaining that because the CDN does the encryption you can trust this domain...
- deleted 12y ago[deleted]
- wslh 12y agoI don't think so. For example, look at this article: https://timnash.co.uk/building-cdn-ssl-cloudfront-certificates/ https://timnash.co.uk/building-cdn-ssl-cloudfront-certificat... they upload their own certificate to the CDN.
- theg2 12y agoI understand that point, I know you can't use the certificate on another domain by design. I'm just curious why you wouldn't issue a certificate to your CDN signed with your domain as well. It's something that bothers me about npr.org especially as it creates problems with their API for member stations wishing to go fully SSL.