# Full (strict), OpenWAF Origin CA and authenticated origin pulls

> Verify the origin's certificate per name, issue free Origin CA certificates for up to 15 years, and let only the edge reach your server.

Origin TLS is now set per name: `full` encrypts without verifying, `full_strict` verifies the origin's certificate. New domains start in `full_strict`; existing ones stay in `full`. The OpenWAF Origin CA issues free origin certificates valid for up to 15 years, from a key it generates (returned once, never kept) or from your own CSR. With authenticated origin pulls the edge presents a client certificate, so your server can refuse every connection that does not come through OpenWAF.

See the [SSL/TLS documentation](https://developers.openwaf.dev/ssl/).