TLS, WAF and CDN at the edge

Three layers sit in front of your servers. TLS encrypts the connection and proves the server's identity. A WAF (web application firewall) filters bad HTTP requests. A CDN (content delivery network) serves cached copies from locations near users. All three should sit at the outermost edge, so traffic meets them before it reaches your servers.

The big idea

Think of the load balancer as the lobby desk, where visitors show ID. Inside the building, you decide whether to check ID again on every floor. That is the choice of end-to-end TLS, which re-encrypts traffic all the way to the pod. The lobby-only model sends cleartext inside a locked VPC.

The lobby analogy has a limit. A lobby check is only as good as the building's walls. If someone gets inside the VPC, nothing else stops them.

Certificates

• ACM (AWS) and Google-managed certificates issue and renew public certificates for ALB, CloudFront and GCLB. Prefer these to uploading files to machines.
• cert-manager does the same job inside Kubernetes, using ACME or a private CA. Watch the rate limits.
• Choose the challenge type carefully. HTTP-01 needs a reachable path. DNS-01 needs permission to change DNS records.
• Redirect HTTP to HTTPS at the load balancer or CDN, not in every app.

WAF and DDoS

A WAF applies rule sets, rate rules, geo blocks and IP allowlists to HTTP requests. Attach it to the outermost edge, such as CloudFront or the load balancer, so bad traffic never uses origin capacity.

Shield Standard, and the Cloud Armor and Maglev protections on GCP, absorb large floods by default. Premium tiers add cost protection and advice, and are worth it when the risk justifies them.

Bot management is a product decision as much as a security one. False positives lock out real users. Start with rate rules and known-bad IP lists.

Walking through a cache key

A CDN caches a response under a cache key, built from parts of the request. Two requests that differ only by a tracking cookie should share one cache entry, so the cookie should not be in the key.

Keys that include every cookie make the hit rate collapse. Keys that ignore a cookie that changes the response serve wrong content. Choose the key on purpose.

Common mistakes

• Caching authenticated API responses. One user's data can be served to the next user. Bypass the cache unless you have a public-cache design.
• Putting WAF rules live without review. A bad rule blocks real users.
• Keeping TLS settings from years ago. Disable old protocols at the load balancer.

Check yourself

1. Why must an authenticated API response bypass a shared cache? The cached copy could be served to the next user, exposing one user's data to another.
2. Why should a WAF sit at the outermost edge? Bad requests are stopped before they use origin capacity.

Key takeaways

• TLS ends at the load balancer or CDN. Decide what happens inside the VPC.
• Use managed certificates and alert on expiry.
• WAF and DDoS protection belong at the outermost edge.
• A cache key decides what is shared. Choose it deliberately.

Further learning

Next, see how to move users between regions safely in shifting traffic between regions. For the CDN pattern itself, see the CDN page.