How edge SSL works

Without edge SSL, either HTTPS travels all the way to origin or you serve HTTP assets off the CDN and browsers block them. EdgeSSL puts the certificate on the same PoP that already holds the object.

Handshake path

1. Browser resolves cdn.example.com via Anycast DNS.
2. TLS terminates at that PoP (EdgeSSL hardware offload in the 2013 stack).
3. If the object is cached, the PoP returns it over HTTPS.
4. On miss, the PoP fetches origin (HTTP on a private fetch or HTTPS) and stores it.

What you provision

• Shared / SAN certificate for a few hostnames, or a wildcard for platform customers.
• Always-on provisioning so rotation does not take the zone offline — the EdgeSSL product claim in 2013.

Next: SAN vs wildcard and mixed content.