To encrypt XML traffic between StoreFront and Delivery Controllers, which action is correct?

To encrypt XML traffic between StoreFront and Delivery Controllers, which action is correct?

• A. Install a private server certificate on each StoreFront server and then add a new Internet Information Services (IIS) binding for HTTPS.
• B. Install a private server certificate on each Delivery Controller and bind the certificates to port 443.
• C. Install a private certificate on each Delivery Controller and StoreFront server. Restart each server to force XML communication to be encrypted.
• D. Install a private server certificate on each StoreFront server. Open the StoreFront console and use the https:// prefix with the base URL.

Answer: (A)

The key idea is to secure the internal XML channel by enabling TLS on the StoreFront web service. By installing a private certificate on each StoreFront server and binding that certificate to port 443 in IIS, the StoreFront site can present a valid TLS endpoint for the XML traffic exchanged with Delivery Controllers. This ensures that the communication between StoreFront and the controllers travels over HTTPS, with encryption in transit and the StoreFront server presenting a trusted certificate to the controllers (assuming the CA is trusted and the hostname matches). Other approaches would involve certificates on the Delivery Controllers or relying on changes that don’t actually enable TLS for the internal XML path, and they also add unnecessary steps like restarts or rely on URL changes rather than binding configurations.

The key idea is to secure the internal XML channel by enabling TLS on the StoreFront web service. By installing a private certificate on each StoreFront server and binding that certificate to port 443 in IIS, the StoreFront site can present a valid TLS endpoint for the XML traffic exchanged with Delivery Controllers. This ensures that the communication between StoreFront and the controllers travels over HTTPS, with encryption in transit and the StoreFront server presenting a trusted certificate to the controllers (assuming the CA is trusted and the hostname matches).

Other approaches would involve certificates on the Delivery Controllers or relying on changes that don’t actually enable TLS for the internal XML path, and they also add unnecessary steps like restarts or rely on URL changes rather than binding configurations.