Where TLS ends

• A

  Traffic between edge and origin is necessarily unencrypted

• B

  The CDN can read the traffic, so it must be trusted with the content

• C

  The origin certificate must be shared with every edge location

• D

  Clients must accept a certificate warning