The difference between TLS termination at the edge and end-to-end TLS is?

The difference between TLS termination at the edge and end-to-end TLS is?

• A. Termination at edge keeps encryption to backend; end-to-end decrypts at edge
• B. Termination at edge decrypts traffic at the edge; end-to-end keeps encryption to backend
• C. Both keep encryption to backend
• D. End-to-end TLS terminates at the edge

Answer: (B)

TLS termination at the edge means the edge device (like a load balancer or CDN edge) completes the TLS handshake with the client and decrypts the traffic there. After decryption, the edge forwards the request to the backend, often as HTTP or with its own TLS to the backend. The key point is that the edge is the point where the data is decrypted, so the backend may see plaintext or have its own separate encryption to it. End-to-end TLS, on the other hand, keeps the TLS session intact all the way to the backend. The edge does not decrypt the traffic; the data remains encrypted while traversing the network and is decrypted only at the backend service. This preserves confidentiality across the entire path. So the statement that best captures the difference is that termination at the edge decrypts traffic at the edge, while end-to-end TLS keeps encryption all the way to the backend. This distinction highlights where decryption happens and whether plaintext is exposed to the intermediate network components.

TLS termination at the edge means the edge device (like a load balancer or CDN edge) completes the TLS handshake with the client and decrypts the traffic there. After decryption, the edge forwards the request to the backend, often as HTTP or with its own TLS to the backend. The key point is that the edge is the point where the data is decrypted, so the backend may see plaintext or have its own separate encryption to it.

End-to-end TLS, on the other hand, keeps the TLS session intact all the way to the backend. The edge does not decrypt the traffic; the data remains encrypted while traversing the network and is decrypted only at the backend service. This preserves confidentiality across the entire path.

So the statement that best captures the difference is that termination at the edge decrypts traffic at the edge, while end-to-end TLS keeps encryption all the way to the backend. This distinction highlights where decryption happens and whether plaintext is exposed to the intermediate network components.