A user reports intermittent TLS errors from one region only. Walk through your diagnosis.
Show the full answer Hide the answer
What the interviewer is testing
Whether you can trace a request path systematically and know where TLS actually terminates.
Establish the path first
Client, DNS resolution, the network path, the CDN or edge, the load balancer, TLS termination point, and any re-encryption to the backend. Errors can originate at any of these, and "TLS error" is a symptom of several unrelated causes.
The candidates, given "one region, intermittent"
One node in the pool has a different certificate. A rolling deployment where one instance did not get the renewed certificate, or a manually configured node. Intermittent because it depends which node serves the request — and this is the classic shape of this symptom.
An expiring certificate in a chain. Not the leaf but an intermediate, or a cross-signed root that expired. Affects clients with different trust stores differently, so it looks intermittent when it is actually client-dependent.
Certificate chain incomplete on some nodes. Missing intermediates work for clients that cache them and fail for those that do not — again client-dependent rather than random.
SNI misconfiguration, so a request without SNI or with an unexpected hostname gets the wrong certificate.
Cipher suite or protocol mismatch after a security hardening change, affecting older clients only.
Middleboxes in one region — a corporate proxy or inspection appliance re-signing traffic.
Clock skew on one node causing validity window failures.
The diagnosis
Connect directly to each backend node and compare certificates and chains — this isolates the "one bad node" case in minutes and it is the most likely cause. Check the full chain against a client that does not cache intermediates. Check expiry on every certificate in the chain, not just the leaf. Correlate failures against client type and region.
What a strong answer adds
The preventive controls: automated certificate deployment so no node can be missed, monitoring that checks the full chain from an external vantage point rather than only the leaf's expiry, and synthetic checks from multiple regions and client types — because a region-specific, client-specific failure is invisible to a single-vantage monitor.
Common weak answers
Renewing the certificate without confirming the cause. Assuming a client-side problem because it is intermittent.