Cloudflare sits on the network between end-user web browsers and website origin servers. Traffic goes from the web browser to Cloudflare. Cloudflare fulfills the request from cache when possible, but when not possible, goes back to the origin web server in a second connection. This request is called an "origin pull".
Browser to Cloudflare
The link between end-user web browsers and Cloudflare benefits from strong security technology -- strong ciphers, SSL with automatically provisioned certificates, and the public CA infrastructure which maps certificates to domain names. Browsers validate the server certificate to ensure they're communicating with the correct web server.
Cloudflare to Origin Server
Authenticated Origin Pulls let origin web servers strongly validate that a web request is coming from Cloudflare. We use TLS client certificate authentication, a feature supported by most web servers, and present a Cloudflare certificate when establishing a connection between Cloudflare and the origin server. By validating this certificate in origin server configuration, access can be limited to Cloudflare connections.
Authenticated Origin Pulls is particularly important when taking advantage of the Cloudflare Web Application Firewall (WAF) security features. By using Authenticated Origin Pulls with a restricted-to-Cloudflare configuration, websites can be sure all traffic has been processed by a state of the art Web Application Firewall.
Please note that once Authenticated Origin Pulls are enforced by your origin server, any HTTPS requests outside of Cloudflare to your origin will fail including those to gray clouded records on Cloudflare.
Handshake
Without Authenticated Origin Pulls, the TLS session between Cloudflare and the origin looks like:
With Authenticated Origin Pulls, connections look like:
Installation
Setting up Apache to use TLS Authenticated Origin Pulls
Setting up NGINX to use TLS Authenticated Origin Pulls
Certificate
Cloudflare uses the following certificate authority to sign certificates for the Authenticated Origin Pull service: