Which TLS termination option terminates TLS at the router and re-encrypts to the backend?

Which TLS termination option terminates TLS at the router and re-encrypts to the backend?

• A. Edge termination
• B. Passthrough
• C. Reencrypt
• D. End-to-end termination

Answer: (C)

Terminating TLS at the router and re-encrypting to the backend means the router handles the client’s TLS handshake, decrypts the request, and then starts a new TLS session to the backend using its own certificate. This is called re-encryption. It gives you encryption on both legs—client to router and router to backend—while letting the router terminate the client TLS and still protect the backend with its own TLS credentials. Edge termination ends TLS at the router and forwards the backend connection in plaintext, so there isn’t a new TLS session to the backend. Passthrough doesn’t terminate TLS at the router at all—the TLS session goes straight to the backend. End-to-end termination implies the router does not terminate the client TLS; the TLS session remains encrypted all the way to the backend.

Terminating TLS at the router and re-encrypting to the backend means the router handles the client’s TLS handshake, decrypts the request, and then starts a new TLS session to the backend using its own certificate. This is called re-encryption. It gives you encryption on both legs—client to router and router to backend—while letting the router terminate the client TLS and still protect the backend with its own TLS credentials.

Edge termination ends TLS at the router and forwards the backend connection in plaintext, so there isn’t a new TLS session to the backend. Passthrough doesn’t terminate TLS at the router at all—the TLS session goes straight to the backend. End-to-end termination implies the router does not terminate the client TLS; the TLS session remains encrypted all the way to the backend.