Authenticated Origin Pulls

Avatar
Ryan L
Follow

An origin pull happens whenever Cloudflare is unable to serve content from our network cache. Cloudflare enables origin pulls that are authenticated through a certificate validation process.

Overview

Cloudflare sits on the network between end-user web browsers and website origin servers.  Traffic goes from the web browser to Cloudflare.  Cloudflare fulfills the request from cache whenever. Otherwise, it goes back to the origin web server in a second connection.  This type of request is called an origin pull.

Browser to Cloudflare

The link between end-user web browsers and Cloudflare benefits from strong security technology -- strong ciphers, SSL with automatically provisioned certificates, and the public CA infrastructure which maps certificates to domain names.  Browsers validate the server certificate to ensure they're communicating with the correct web server.

Cloudflare to Origin Server

Authenticated Origin Pulls let origin web servers strongly validate that a web request is coming from Cloudflare.  We use TLS client certificate authentication, a feature supported by most web servers, and present a Cloudflare certificate when establishing a connection between Cloudflare and the origin server.  By validating this certificate in origin server configuration, access can be limited to Cloudflare connections.

Authenticated Origin Pulls is particularly important when taking advantage of the Cloudflare Web Application Firewall (WAF) security features.  By using Authenticated Origin Pulls with a restricted-to-Cloudflare configuration, websites can be sure all traffic has been processed by a state of the art Web Application Firewall.

 
Once Authenticated Origin Pulls are enforced by your origin server, any HTTPS requests outside of Cloudflare to your origin will fail including those to gray clouded records on Cloudflare.

Handshake

Without Authenticated Origin Pulls, the TLS session between Cloudflare and the origin looks like:

Normal TLS handshake

With Authenticated Origin Pulls, connections look like:

Client authenticated TLS handshake

Installation

 
Currently, the Authenticated Origin Pulls feature is incompatible with Load Balancing health checks and Railgun.

Certificate

Cloudflare uses the following certificate authority to sign certificates for the Authenticated Origin Pull service:

Was this article helpful?
14 out of 19 found this helpful
Still not finding what you need?

The Cloudflare team is here to help. 95% of questions can be answered using the search tool, but if you can’t find what you need, submit a support request.

Submit a request

Popular questions: Why is my site slow, 522 errors, I'm expecting a spike in traffic

Powered by Zendesk