Transport Layer Security creates a protected channel between protocol peers. The application determines the intended peer and how its authentication is interpreted; a provider-authorised CDN edge can be such a peer. Channel protection does not make that peer unable to read data delivered to it.[ref]
The Transport Layer Security Protocol Version 1.3 (RFC 8446). §1: channel properties and application authentication interpretation
TLS termination occurs at a TLS peer that decrypts incoming records and participates in the channel authentication and key agreement. An intermediary terminating one TLS channel and initiating another is an endpoint of each channel, not an opaque forwarder.
Suppose client A uses a protected channel to proxy P, which reads the message and sends it over a second protected channel to service B. Even if both channels protect against outsiders, P has the plaintext by construction. Therefore the conjunction of those channel protections does not imply cryptographic confidentiality from P. This counterexample does not imply that P is unauthorised; it identifies a trust assumption that application designers must state.
Articles by others on the same topic
Transport Layer Security (TLS) is a cryptographic protocol designed to provide secure communication over a computer network. It is widely used to protect data transmitted between a client (such as a web browser) and a server (such as a web server), ensuring privacy, data integrity, and authentication. ### Key Features of TLS: 1. **Encryption**: TLS encrypts the data being transmitted, which helps protect it from eavesdroppers and man-in-the-middle attacks.