Authenticated Origin Pulls – Cloudflare Support

An origin pull happens whenever Cloudflare is unable to serve content from our network cache. Cloudflare enables origin pulls that are authenticated through a certificate validation process.

Overview
Browser to Cloudflare
Cloudflare to Origin Server
TLS Handshake
Installing on Apache and NGINX
Origin Pull Certificate

Overview

Cloudflare sits on the network between end-user web browsers and website origin servers. Traffic goes from the web browser to Cloudflare. Cloudflare fulfills the request from cache whenever. Otherwise, it goes back to the origin web server in a second connection. This type of request is called an origin pull.

Browser to Cloudflare

The link between end-user web browsers and Cloudflare benefits from strong security technology -- strong ciphers, SSL with automatically provisioned certificates, and the public CA infrastructure which maps certificates to domain names. Browsers validate the server certificate to ensure they're communicating with the correct web server.

Cloudflare to Origin Server

Authenticated Origin Pulls let origin web servers strongly validate that a web request is coming from Cloudflare. We use TLS client certificate authentication, a feature supported by most web servers, and present a Cloudflare certificate when establishing a connection between Cloudflare and the origin server. By validating this certificate in origin server configuration, access can be limited to Cloudflare connections.

Authenticated Origin Pulls is particularly important when taking advantage of the Cloudflare Web Application Firewall (WAF) security features. By using Authenticated Origin Pulls with a restricted-to-Cloudflare configuration, websites can be sure all traffic has been processed by a state of the art Web Application Firewall.

TLS Handshake

Without Authenticated Origin Pulls, the TLS session between Cloudflare and the origin looks like:

With Authenticated Origin Pulls, connections look like:

Client authenticated TLS handshake

Installing on Apache and NGINX

Click below to expand instructions for configuring TLS Authenticated Origin Pulls for either NGINX or Apache origin web servers:

For authenticated origin pulls to work, use Full SSL in the Cloudflare Crypto app, and update the origin web server SSL configuration. Download origin-pull-ca.pem and place the certificate in a file on your origin web server, for example in /path/to/origin-pull-ca.pem

Then add these lines to the SSL configuration for your origin web server:

SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /path/to/origin-pull-ca.pem

Then add these lines to the SSL configuration for your origin web server:

    ssl_client_certificate /etc/nginx/certs/cloudflare.crt;
    ssl_verify_client on;

Origin Pull Certificate

Cloudflare uses the following certificate authority to sign certificates for the Authenticated Origin Pull service: