# Exercise 2 — TLS Termination Architecture Decision

## Scenario

Your team is deploying a new internal API. The infrastructure will be: internet clients → a reverse-proxy/load balancer at the network edge → several backend app server instances on a private internal network → a database.

## Deliverables

1. **Termination point.** Propose where TLS should terminate (edge proxy only, or edge proxy AND re-encrypted to the backend), and justify your choice against theory section 6 — cover both the operational benefit (certificate management, CPU offload) of terminating at the edge, and the argument for re-encrypting the internal hop.

2. **Compliance twist.** The company later signs a customer contract requiring that "no unencrypted traffic exists anywhere in the request path, including internal hops." Revise your architecture diagram from part 1 to satisfy this, and explain the specific operational cost this adds (what now has to be managed that didn't before) using theory section 6's tradeoff discussion.

3. **Forward secrecy justification.** Explain, for a security review document, why the specific choice to require TLS 1.3 (or TLS 1.2 with a Diffie-Hellman cipher suite) rather than allowing older non-forward-secret cipher suites matters for this API — reference what forward secrecy actually protects against per theory section 2, framed around a scenario where the server's private key is compromised a year from now.

4. **Certificate expiry incident prevention.** Given theory section 7's point that expired certificates are a common, entirely preventable outage cause, propose one concrete operational practice (not a TLS protocol detail) that would prevent this from happening to your new API in production.