Can be SSL or not to the origin. Plus there's the Railgun option that also uses TLS.