Where is TLS termination typically performed in a CDX architecture to secure communications?

Where is TLS termination typically performed in a CDX architecture to secure communications?

• A. It enforces content-type checks.
• B. TLS termination at the gateway offloads cryptographic work and simplifies certificate management.
• C. It compresses responses to speed up delivery.
• D. It disables encryption for performance.

Answer: (B)

TLS termination is performed at the gateway in a CDX architecture. The TLS handshake with clients ends at the gateway, which then decrypts the traffic and forwards the requests to internal services. This offloads the heavy cryptographic work from backend servers, reducing CPU load and latency under TLS-heavy traffic, and it centralizes certificate management in one place at the gateway. It also makes it easier to apply security policies, inspect traffic, and rotate certificates since everything is handled at the edge rather than on every backend service. After termination, the gateway can re-encrypt the traffic to internal services if you want end-to-end encryption inside the network, or forward it in plaintext within a trusted internal network. Other options describe functions like content-type checks, which are handled by application logic, or performance optimizations like compression, neither of which addresses where TLS is terminated. Disabling encryption would defeat the purpose of securing communications.

TLS termination is performed at the gateway in a CDX architecture. The TLS handshake with clients ends at the gateway, which then decrypts the traffic and forwards the requests to internal services. This offloads the heavy cryptographic work from backend servers, reducing CPU load and latency under TLS-heavy traffic, and it centralizes certificate management in one place at the gateway. It also makes it easier to apply security policies, inspect traffic, and rotate certificates since everything is handled at the edge rather than on every backend service. After termination, the gateway can re-encrypt the traffic to internal services if you want end-to-end encryption inside the network, or forward it in plaintext within a trusted internal network.

Other options describe functions like content-type checks, which are handled by application logic, or performance optimizations like compression, neither of which addresses where TLS is terminated. Disabling encryption would defeat the purpose of securing communications.