I have a question regarding the combination of CDN's & PFS configured servers.
A client of mine uses Akamai's CDN services on a large scale. Most of the clients application is on Clear-text pure HTTP. On payments pages, HTTPS is enforced and only allowing key exchange algorithms which provide PFS.
My question is, in case of Akamai having to examine traffic for WAF's/DDoS mitigation solution, will they be able to decrypt the traffic for each connection although the existence of PFS?