Which TLS termination options are supported for an OpenShift Route?

• A. Only Edge termination
• B. Reencrypt termination
• C. Passthrough termination
• D. Edge termination, Reencrypt termination, and Passthrough termination

Answer: (D)

OpenShift Route TLS termination can be handled in three ways: edge termination, reencrypt termination, and passthrough termination. Each mode defines where the TLS handshake ends and how the traffic to the backend is handled.

Edge termination means the router terminates the client TLS at the router using a certificate you assign to the route, and then forwards the requests to the backend—typically as plain HTTP. This centralizes certificate management at the edge and is simple to set up.

REENCRYPT termination also has the router terminate the client TLS, but then the router establishes a new TLS connection to the backend. This provides end-to-end encryption from client to backend, while the router handles the certificate needed for the connection to the backend.

Passthrough termination does not terminate TLS at the router at all—the TLS handshake remains end-to-end between the client and the backend service. The router simply forwards the encrypted traffic to the destination, leaving certificate management entirely to the service.

Because OpenShift Routes support all three modes, the best answer is that edge termination, reencrypt termination, and passthrough termination are all supported.