How secure is a setup that consists of an SSL-protected CDN and a http-only origin? In other words, the client connects to the CDN using SSL, but the CDN talks to the origin via http.
Generally, man in the middle attacks occur in locations with public wifi. But what about CDN data centers? Is there enough vulnerability for me to look for different options?
I'd say avoid this. You don't want your customers to find out you're not using real HTTPS.
Generally, man in the middle attacks occur in locations with public wifi. But what about CDN data centers? Is there enough vulnerability for me to look for different options?
This is quite a bolt assumption, in fact you have no clue whether that's true or not since an adversary may be intercepting all network traffic on the physical level. If you use SSL/TLS, apparently you want to assure things are kept private, that's doesn't works with half a solution. You'd be better off without any SSL than doing it half. If you set a SSL between the CDN and the origin, then use a CA signed certificate, not self-signed certificate which is a common mistake.
If you use a certificate between the client and CDN just to show you have taken care of security, the best that might happen can be they find out there is actually nothing between the CDN and the origin and they let you know. In the worst case data is actually leaked. Either way you will have to take security seriously.
