How do you encrypt traffic to a server that can't do HTTPS?

An older web server on a screened subnet is serving unencrypted web traffic. The server is not capable of serving HTTPS traffic directly, but the firewall is capable of doing so. Which of the following should be done to encrypt all traffic coming into the web server from outside the network? (Choose two.)

A certificate should be installed on the server.
Incoming port 80 traffic at the firewall should be forwarded to port 443 on the server.
Incoming port 80 traffic at the firewall should be forwarded to port 80 on the server.
Incoming port 443 traffic at the firewall should be forwarded to port 80 on the server. Source Reference Answer
A certificate should be installed on the firewall. Source Reference Answer

Community Votes

100%

100% of anonymous learners picked answer DE. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests SSL/TLS offloading; the trap is assuming the certificate must be installed on the web server or that port 80 traffic should be forwarded to port 443 on the server, but the firewall must terminate TLS because the server lacks HTTPS capability.

When a legacy web server cannot handle HTTPS, CompTIA Network+ N10-008 community consensus is to perform SSL/TLS termination at the firewall: install the certificate on the firewall and forward incoming HTTPS (port 443) to the server's HTTP port 80. This encrypts all external traffic while the server continues receiving unencrypted traffic internally.

Option B (forwarding port 80 to port 443 on the server) is a common wrong answer because it appears to redirect HTTP to HTTPS, but it requires the server to handle HTTPS, which the question explicitly says it cannot. The correct pair is D and E, not B/E or A/B.

Community Discussion (6 comments)

subaie503 👍 6 Selected: DE

To encrypt all traffic coming into the web server from outside the network, the following steps should be taken: Install a certificate on the firewall: The firewall should be configured to handle the encryption and decryption of HTTPS traffic. This involves installing a valid SSL/TLS certificate on the firewall to secure the incoming web traffic. Incoming port 80 traffic at the firewall should be forwarded to port 443 on the server: Since the web server is not capable of serving HTTPS traffic directly, incoming HTTP (port 80) traffic should be forwarded to port 443 (HTTPS) on the server by the firewall. This allows the firewall to handle the encryption and forward the secure traffic to the web server.

21bc1a0 👍 2 Selected: DE

keywords: The server is not capable of serving HTTPS traffic directly (no port 443 on Server)

BigDazza_111 👍 3 Selected: DE

It would be uncommon these days to expect web users to connect to your web server over an un-encrypted internet connection i.e http. I'm going with D and E.

fartphilosopher89 👍 1 Selected: BE

B and E

Bunaventi 👍 2 Selected: AB

gpt: A. A certificate should be installed on the server. B. Incoming port 80 traffic at the firewall should be forwarded to port 443 on the server. Explanation: Install a certificate on the server (A): Even though the server cannot serve HTTPS traffic directly, you can install a certificate on the server to handle the encryption once the traffic reaches it. Forward port 80 traffic to port 443 at the firewall (B): Since the server cannot handle HTTPS traffic directly, the firewall can be configured to forward incoming port 80 (HTTP) traffic to port 443 (HTTPS) on the server, where the encryption can be applied. These measures allow encryption to be implemented at the firewall, even if the web server itself cannot handle HTTPS traffic directly.

dblue 👍 1 Selected: BE

I feel like its B over D because incoming port 80 (HTTP) traffic at the firewall should be forwarded to port 443 (HTTPS) on the server. This ensures that all HTTP traffic coming into the network is redirected to the HTTPS port (443) on the server, where the firewall can handle encryption.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The server is not capable of serving HTTPS directly, so security must be handled at the firewall. Installing a certificate on the firewall (E) lets the firewall terminate TLS and decrypt traffic.
Incoming port 443 traffic from outside should be forwarded to port 80 on the server (D). This way, external clients connect over HTTPS to the firewall, and the firewall forwards decrypted HTTP to the server. This is the standard SSL/TLS termination or offloading model.
The highest-voted comment [1] correctly states: "Install a certificate on the firewall: The firewall should be configured to handle the encryption and decryption of HTTPS traffic. Incoming port 443 traffic at the firewall should be forwarded to port 80 on the server."

Why the Other Options Are Wrong

Option A is wrong because installing a certificate on the server does not help if the server cannot serve HTTPS traffic; the server has no TLS stack or listener to use it.
Option B is wrong because forwarding port 80 to port 443 on the server would require the server to listen on 443 and handle TLS, which contradicts the stated limitation.
Option C simply forwards port 80 to port 80, keeping HTTP unencrypted and providing no encryption or redirection to HTTPS.
Be careful not to choose B/E or A/B. B is a common mistake that assumes the server can handle HTTPS after the firewall forwards traffic, but the whole point is that the firewall must terminate SSL.

Community Comment Notes

The community overwhelmingly voted for D and E with 73 votes. Comment [3] highlights the key phrase: "The server is not capable of serving HTTPS traffic directly (no port 443 on Server)." This directly points to D/E.
Comment [2] notes that web users should not be expected to connect over unencrypted internet connections, reinforcing the need to terminate HTTPS at the firewall.
One comment [4] incorrectly suggested A and B, showing a common misunderstanding of SSL termination. The correct answer is D and E, not A and B.

Official Reference

Exam Strategy

Look for phrases like 'server is not capable' and 'firewall is capable' — these indicate SSL/TLS termination at the firewall. When that appears, the answer always involves installing the certificate on the firewall and forwarding the secure external port (443) to the internal unencrypted port (80).

Related Analysis

← Back to N10-008 Study Guide