How is TLS handshake and certificate trust managed across many SD-WAN devices?

• A. TLS handshake negotiates the lowest common version and can use self-signed certificates.
• B. TLS handshake negotiates the highest supported version, uses certificates issued by a trusted CA, validates certificate chains, and handles revocation if needed.
• C. TLS handshake is not used in SD-WAN.
• D. Each device uses a single certificate shared across all devices.

Answer: (B)

TLS handshake in SD-WAN establishes a secure, trusted channel by negotiating the highest TLS version both ends support, authenticating identities with certificates issued by trusted authorities, and validating the certificate chain along with revocation status. In practice, devices present certificates signed by a CA, the peer verifies the chain up to a trusted root, checks that the certificate is still valid, and performs revocation checks (via OCSP or CRLs) if needed. This combination provides mutual authentication and a fresh, encrypted session key for secure communication across many devices.

This scale matters: using CA-issued, unique certificates per device lets you manage trust centrally and revoke or rotate credentials for a single device without affecting others. Relying on a single shared certificate or using self-signed certs would complicate trust management and weaken security across a large fleet. The approach described ensures robust, scalable trust across all SD-WAN devices.