Origin certificates are installed on your origin server so that the edge can verify it when a name uses the origin TLS mode full_strict. They are signed by the OpenWAF Origin CA, which only the OpenWAF edge trusts. Issuing and revoking them is audited but does not create a zone version.
origin-certs list
origin-certs list <zone> [--json]The zone's origin certificates, newest first: id, status (vigente active, revocado revoked, caducado expired), names, key type, expiry and serial. Private keys are never shown.
origin-certs create
origin-certs create <zone> <name>… --cert-out <file|-> [--key-out <file|->] [--key-type ecdsa|rsa] [--days N] [--csr <file>] --reason "…"Issues a certificate for one or more names: the zone itself, names below it, or wildcards *.name. The API checks the request first; after you confirm, the certificate is issued and written.
| Option | Meaning |
|---|---|
--cert-out <file|-> | Required. New file for the certificate followed by the Origin CA (PEM); - writes to standard output. |
--key-out <file|-> | Required without --csr. New file for the private key, created with mode 0600; - writes to standard output. OpenWAF generates the key, hands it over once and does not keep it. |
--key-type ecdsa|rsa | Key OpenWAF generates: ecdsa (P-256, default) or rsa (2048 bits). Ignored with --csr. |
--days N | Validity: 7, 30, 90, 365, 730, 1095 or 5475 (15 years, the default). |
--csr <file> | A PEM certificate request made on the origin. The key never leaves your server; --key-out is then not allowed. |
The CLI never overwrites a file: if --cert-out or --key-out exists, it stops before calling the API. --cert-out and --key-out cannot both be -.
openwaf-cloud ctl origin-certs create example.com example.com '*.example.com' \
--cert-out origin.pem --key-out origin.key --reason "New origin server"Install both files on the origin, then set the zone (or the name) to origin.tls_verify=full_strict with zones set.
origin-certs revoke
origin-certs revoke <zone> <id> --reason "…"Revokes an origin certificate (id from origin-certs list). Edge nodes reject it in full_strict from their next configuration, so an origin still serving it gets 526 errors. Revoking an already revoked certificate does nothing.
origin-tls status
origin-tls status <zone> [--json]For each proxied name: its origin, the TLS mode (full encrypts without verifying, full_strict verifies), the name verified, whether the edge presents its client certificate (mTLS) and whether the origin asks for one, what a check from the control plane sees on the origin (certificate expiry and who it is trusted by) and the edge's 525/526 errors in the last 24 hours. The check is cached for 60 seconds.
origin-tls ca
origin-tls ca [--client]Prints a public CA bundle in PEM. Needs no token.
| Option | Meaning |
|---|---|
| (none) | The OpenWAF Origin CA: what the edge trusts, besides public CAs, in full_strict. |
--client | The edge's client CA: what your origin must trust if it requires the edge's client certificate. |
openwaf-cloud ctl origin-tls ca --client > openwaf-edge-client-ca.pem