The SSL can be enabled(Terminated) at multiple levels, e.g., CDN, Load Balancer, Dispatcher, and AEM; for most of the marketing sites, the SSL is uploaded to the CDN layer and terminated there - which means the communication from the browser to CDN is HTTPS but from CDN to below layers is HTTP, based on your security needs - some may require an end to end encryption, you can terminate the SSL at any level(X-Forwarded-Proto header can be used at Dispatcher/AEM to identify which protocol client used to connect to the website)
Regards
Tech Learnings – Medium
.