Enable origin SSL validation

Origin SSL validation makes CDN edge servers verify the origin TLS certificate before completing an HTTPS pull. Without it, CDN-to-origin HTTPS traffic can still be exposed to a man-in-the-middle attack because edge servers do not check that the origin certificate is valid and issued for the expected host.

Configure the origin pull protocol to HTTPS to secure all origin pulls with TLS. With HTTP and HTTPS, origin SSL validation applies only when the CDN uses HTTPS for the origin request.

Configure origin SSL validation through the CDN API. An API token is required.

Compatible certificates

Upload the public CA certificate that issued the origin certificate. For a self-signed origin certificate, upload that certificate as the trusted certificate.

Gcore automated Let’s Encrypt certificates used for client HTTPS delivery cannot be used for origin SSL validation. The client certificate referenced by proxy_ssl_data must be a manually uploaded SSL certificate.

The API requires proxy_ssl_data when origin SSL validation is enabled, but the origin determines whether client authentication is optional or mandatory. To require mutual TLS, configure the origin to request a client certificate, trust the CA that issued the uploaded client certificate, and reject connections that do not present a valid certificate.

Connection flow

The certificate validation process works as follows.

1. On a cache miss, a CDN edge server connects to the origin over HTTPS.
2. The origin presents its X.509 certificate. The edge server validates the certificate chain using the trusted CA (proxy_ssl_ca) and presents the client certificate (proxy_ssl_data) when the origin requires it.
3. If validation succeeds, the edge server pulls the content and serves it to the client.

API configuration

Use the CDN API to configure the required certificates and resource fields.

1. Create a trusted CA certificate with Add CA certificate. Note the returned certificate ID.

2. Create a manually uploaded (non-automated) SSL certificate with Add SSL certificate. Note the returned certificate ID.

3. Update the CDN resource with Change CDN resource:

   • Set originGroup to the ID of the existing origin group attached to the CDN resource.
   • Set proxy_ssl_ca to the trusted CA certificate ID.
   • Set proxy_ssl_data to the client SSL certificate ID.
   • Set proxy_ssl_enabled to true.

   The minimal request body includes the existing origin-group ID and the three SSL validation fields:

   {
     "originGroup": 12345,
     "proxy_ssl_ca": 67890,
     "proxy_ssl_data": 67891,
     "proxy_ssl_enabled": true
   }
   

   Replace the numeric values with the existing origin-group ID and the certificate IDs returned in the previous steps.

Both proxy_ssl_ca and proxy_ssl_data are required when proxy_ssl_enabled is true, even when the origin does not require client authentication.