SSL/TLS with CDN: Configuration Guide 2025

CDNs provide global SSL/TLS termination at edge locations, improving performance and security. This guide covers SSL configuration with major CDN providers.

CDN SSL Benefits

• Reduced latency with edge termination
• DDoS protection
• Automatic certificate management
• Global anycast network
• HTTP/2 and HTTP/3 support

Cloudflare SSL Configuration

# SSL/TLS Encryption Modes
# 1. Off - No encryption (not recommended)
# 2. Flexible - CDN to client encrypted, CDN to origin unencrypted
# 3. Full - End-to-end encryption (self-signed OK)
# 4. Full (Strict) - End-to-end with valid certificate (recommended)

# Enable via Cloudflare Dashboard:
# SSL/TLS → Overview → Full (Strict)

Cloudflare Origin Certificate

# Generate origin certificate in Cloudflare dashboard
# SSL/TLS → Origin Server → Create Certificate

# Install on origin server (Nginx)
server {
    listen 443 ssl;
    server_name example.com;
    
    ssl_certificate /path/to/cloudflare-origin.pem;
    ssl_certificate_key /path/to/cloudflare-origin-key.pem;
    
    # Only allow Cloudflare IPs
    allow 173.245.48.0/20;
    allow 103.21.244.0/22;
    deny all;
}

AWS CloudFront SSL

# Request ACM certificate
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names www.example.com \
  --validation-method DNS \
  --region us-east-1

# CloudFront distribution config
{
  "ViewerCertificate": {
    "ACMCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/abc123",
    "SSLSupportMethod": "sni-only",
    "MinimumProtocolVersion": "TLSv1.2_2021"
  }
}

Custom SSL Certificate Upload

# Cloudflare custom certificate
# Dashboard → SSL/TLS → Edge Certificates → Upload Custom Certificate

# AWS CloudFront
aws iam upload-server-certificate \
  --server-certificate-name my-cert \
  --certificate-body file://cert.pem \
  --private-key file://privkey.pem \
  --certificate-chain file://chain.pem

SSL/TLS Settings

CDN SSL Benefits

Content Delivery Networks provide SSL/TLS termination at edge locations worldwide, reducing latency for users by serving content from geographically closer servers. CDNs handle certificate management, protocol optimization, and DDoS protection, offloading these responsibilities from origin servers.

Major CDN Providers

Cloudflare SSL

Cloudflare offers free SSL certificates with automatic renewal, flexible SSL modes (Off, Flexible, Full, Full Strict), and advanced features like Authenticated Origin Pulls. Cloudflare's Universal SSL provides certificates for all domains on their network, even free plans.

# Cloudflare SSL Modes
1. Off: No encryption (not recommended)
2. Flexible: CDN to client encrypted, CDN to origin unencrypted
3. Full: End-to-end encryption, accepts self-signed origin certificates
4. Full (Strict): End-to-end encryption, requires valid origin certificate

# Recommended: Full (Strict) with Origin CA certificate

AWS CloudFront

AWS CloudFront integrates with AWS Certificate Manager (ACM) for free SSL certificates. CloudFront supports custom SSL certificates, SNI (Server Name Indication), and dedicated IP addresses for legacy client support. CloudFront provides detailed SSL/TLS metrics through CloudWatch.

Fastly

Fastly offers instant certificate provisioning, TLS 1.3 support, and real-time certificate updates. Fastly's edge computing platform (Compute@Edge) enables custom SSL logic at the edge. Fastly provides detailed TLS analytics and performance metrics.

Origin SSL Configuration

Secure the connection between CDN and origin servers using origin certificates. CDN providers offer origin CA certificates that are trusted only by their network, providing security without the overhead of publicly trusted certificates.

# Cloudflare Origin CA Certificate
1. Generate origin certificate in Cloudflare dashboard
2. Install certificate on origin server
3. Configure Cloudflare SSL mode to Full (Strict)
4. Restrict origin server to accept only Cloudflare IPs

# Nginx origin configuration
server {
    listen 443 ssl http2;
    ssl_certificate /etc/nginx/ssl/cloudflare-origin.pem;
    ssl_certificate_key /etc/nginx/ssl/cloudflare-origin-key.pem;
    
    # Restrict to Cloudflare IPs
    allow 173.245.48.0/20;
    allow 103.21.244.0/22;
    # ... additional Cloudflare IP ranges
    deny all;
}

Certificate Management

Automated Certificate Provisioning

Modern CDNs automatically provision and renew SSL certificates using ACME protocol. Configure DNS records to point to CDN, and certificates are issued within minutes. Automatic renewal ensures certificates never expire.

Custom Certificates

Upload custom certificates for specific branding requirements or extended validation (EV) certificates. Custom certificates require manual renewal management. Most CDNs support multiple certificates per distribution for different domains.

Performance Optimization

TLS 1.3 and HTTP/3

Enable TLS 1.3 and HTTP/3 (QUIC) at CDN edge for optimal performance. These protocols reduce handshake latency and improve connection reliability. CDN providers handle protocol negotiation automatically.

Edge Caching

Configure appropriate cache headers for SSL-served content. Use Cache-Control and CDN-specific headers to control caching behavior. Implement cache purging strategies for content updates.

Security Features

DDoS Protection

CDNs provide DDoS protection at the edge, absorbing attacks before they reach origin servers. SSL/TLS termination at the edge protects against SSL-based attacks. Rate limiting and bot management enhance security.

WAF Integration

Web Application Firewalls (WAF) inspect decrypted traffic at CDN edge, blocking malicious requests before they reach origin servers. Configure WAF rules for common attacks like SQL injection and XSS.

Multi-CDN Strategies

Use multiple CDN providers for redundancy and performance optimization. Implement DNS-based traffic steering to route users to optimal CDN. Maintain consistent SSL configuration across all CDN providers.

Monitoring and Analytics

Monitor SSL/TLS metrics including handshake time, protocol distribution, and cipher suite usage. Track certificate expiration and renewal status. Use CDN analytics to identify performance bottlenecks and security threats.

Cost Optimization

Understand CDN pricing models for SSL traffic. Some CDNs charge extra for custom certificates or dedicated IP addresses. Optimize cache hit ratios to reduce origin traffic and costs. Use tiered caching for frequently accessed content.

Best Practices

• Use Full (Strict) mode for end-to-end encryption
• Enable HSTS with preload
• Configure origin to only accept CDN traffic
• Use HTTP/2 and HTTP/3 for performance
• Monitor certificate expiration
• Enable automatic HTTPS rewrites