I have a question regarding the combination of CDN's & PFS configured servers.

A client of mine uses Akamai's CDN services on a large scale. Most of the clients application is on Clear-text pure HTTP. On payments pages, HTTPS is enforced and only allowing key exchange algorithms which provide PFS.

My question is, in case of Akamai having to examine traffic for WAF's/DDoS mitigation solution, will they be able to decrypt the traffic for each connection although the existence of PFS?


I'm not familiar with Akamai's infrastructure but since they are the endpoint of the HTTPS connection there is no need to decrypt their own traffic. Instead they can have some SSL termination somewhere in their system and from then on could analyze all traffic in clear. Also, it is not uncommon to have WAF functionality and webserver integrated in one system. And most of the DoS protection is done at layer 3 and 4 anyway, i.e. it does not care if the traffic is encrypted or not. Thus I very much doubt that they would even try to decrypt the traffic since this much easier and cheaper ways for traffic inspection exist.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.