To encrypt XML traffic between StoreFront and the Delivery Controllers, on which component should the private certificate be installed?

To encrypt XML traffic between StoreFront and the Delivery Controllers, on which component should the private certificate be installed?

• A. StoreFront
• B. Delivery Controllers
• C. Both
• D. Clients

Answer: (A)

The TLS channel for the XML broker traffic is terminated at the component that serves as the endpoint for that traffic. For the XML communication between StoreFront and Delivery Controllers, the StoreFront server acts as the TLS endpoint, so it must hold the private key for the certificate used to encrypt that path. When the Delivery Controllers connect to StoreFront, they establish an encrypted channel using StoreFront’s certificate; the private key on StoreFront is what enables the TLS handshake and decryption of the traffic from SF to the DCs. Placing the private certificate on the Delivery Controllers would put the TLS endpoint on the DC side, which isn’t the configuration described here. Clients don’t need the private key for this traffic, and having the key on StoreFront is what protects the XML messages exchanged with the DCs.

The TLS channel for the XML broker traffic is terminated at the component that serves as the endpoint for that traffic. For the XML communication between StoreFront and Delivery Controllers, the StoreFront server acts as the TLS endpoint, so it must hold the private key for the certificate used to encrypt that path. When the Delivery Controllers connect to StoreFront, they establish an encrypted channel using StoreFront’s certificate; the private key on StoreFront is what enables the TLS handshake and decryption of the traffic from SF to the DCs. Placing the private certificate on the Delivery Controllers would put the TLS endpoint on the DC side, which isn’t the configuration described here. Clients don’t need the private key for this traffic, and having the key on StoreFront is what protects the XML messages exchanged with the DCs.