An origin pull happens whenever Cloudflare is unable to serve content from our network cache. Cloudflare enables origin pulls that are authenticated through a certificate validation process.
Cloudflare sits on the network between end-user web browsers and website origin servers. Traffic goes from the web browser to Cloudflare. Cloudflare fulfills the request from cache whenever. Otherwise, it goes back to the origin web server in a second connection. This type of request is called an origin pull.
Browser to Cloudflare
The link between end-user web browsers and Cloudflare benefits from strong security technology -- strong ciphers, SSL with automatically provisioned certificates, and the public CA infrastructure which maps certificates to domain names. Browsers validate the server certificate to ensure they're communicating with the correct web server.
Cloudflare to Origin Server
Authenticated Origin Pulls let origin web servers strongly validate that a web request is coming from Cloudflare. We use TLS client certificate authentication, a feature supported by most web servers, and present a Cloudflare certificate when establishing a connection between Cloudflare and the origin server. By validating this certificate in origin server configuration, access can be limited to Cloudflare connections.
Authenticated Origin Pulls is particularly important when taking advantage of the Cloudflare Web Application Firewall (WAF) security features. By using Authenticated Origin Pulls with a restricted-to-Cloudflare configuration, websites can be sure all traffic has been processed by a state of the art Web Application Firewall.
Without Authenticated Origin Pulls, the TLS session between Cloudflare and the origin looks like:
With Authenticated Origin Pulls, connections look like:
- Setting up Apache to use TLS Authenticated Origin Pulls
- Setting up NGINX to use TLS Authenticated Origin Pulls
Cloudflare uses the following certificate authority to sign certificates for the Authenticated Origin Pull service: