Learning objectives
- Explain TLS authentication separately from HTTP
- Draw the two TLS legs of a reverse proxy
- Diagnose hostname and trust-chain failures
The mental model
HTTPS protects HTTP communication using TLS, but encryption and application correctness are different questions. A certificate helps the client authenticate the server name and establish a secure connection. It does not guarantee that the server returns the right data or that the user is authorized. With a reverse proxy, the browser usually establishes TLS with the edge, and the edge establishes a separate connection to the origin. Both legs need appropriate security and validation. A green browser indicator can coexist with an origin-side certificate problem. Troubleshooting becomes much clearer when you draw those two connections and identify which participant is validating which certificate.
How it works
During a modern TLS handshake, peers negotiate supported parameters, establish shared secrets, and authenticate the server using certificate information and proof of private-key possession. The client checks the requested hostname, certificate validity, and trust chain according to its implementation and policy. Server Name Indication helps a server select the appropriate certificate for the requested hostname. HTTP then supplies methods, request targets, headers, status codes, and bodies over the established secure transport.
A reverse proxy terminates one connection and creates or reuses another, so certificate stores, supported versions, hostnames, and trust requirements can differ on each leg. For Cloudflare, inspect the SSL/TLS mode and origin certificate configuration rather than assuming browser success proves strict origin validation. Prefer a design that validates the origin certificate, and resolve certificate problems instead of treating disabled verification as a permanent repair. For debugging, capture the requested hostname, certificate chain, expiration, SNI, and error stage. Preserve the hostname when making controlled origin tests; connecting by raw IP can select a different certificate or virtual host. Once TLS succeeds, interpret HTTP responses separately: a 403 is an application or policy decision, not a certificate negotiation failure.
Applied example · hypothetical
Hypothetical example: customers receive an edge-generated origin TLS error after a certificate rotation. The browser certificate is valid, so the customer initially rejects TLS as a cause. You show the second connection and find the origin certificate does not cover the hostname used on that leg. A controlled handshake with the expected SNI reproduces the issue. The fix restores correct origin identity and validation. Turning off verification might hide the symptom but would weaken the intended trust model and leave the underlying configuration wrong.
In a customer engagement
In a Cloudflare engagement, explain browser-to-edge and edge-to-origin TLS separately, including who owns certificate renewal. Ask whether origin hostnames or routing changed recently. Confirm the mode against current documentation. Give the customer a repair and verification plan that preserves encryption and authentication, and avoid presenting a permissive mode as a general solution to certificate errors.
Interview relevance
Interviewers may use a valid browser certificate as a distraction. State that each TLS leg has its own validation context, then ask for the error location. Show you understand SNI, hostname matching, and trust chains without reciting cipher names that do not help isolate the failure.
Common mistakes
- Disabling validation as a permanent fix
- Testing an origin IP without preserving hostname context
- Equating encryption with user authorization
Key terminology
TLS — The protocol family used to authenticate peers and protect transport confidentiality and integrity.
SNI — A TLS extension carrying the requested server name to help select the appropriate configuration.
Certificate chain — A sequence linking a server certificate through issuers to a trusted authority.
Explain it without the page
- Who validates each certificate in a proxied request?
- How could a certificate rotation affect only the origin leg?
Further reading
Sources explain the underlying concepts; examples and practice answers are original course material. Recheck current limits and plan eligibility before a real proposal.