# origin-certs and origin-tls

> Issue, list and revoke OpenWAF Origin CA certificates for your origin servers, check TLS from the edge to each origin and download the CA bundles.

Origin certificates are installed on **your** origin server so that the edge can verify it when a name uses the origin TLS mode `full_strict`. They are signed by the OpenWAF Origin CA, which only the OpenWAF edge trusts. Issuing and revoking them is audited but does not create a zone version.

## origin-certs list

```text
origin-certs list <zone> [--json]
```

The zone's origin certificates, newest first: id, status (`vigente` active, `revocado` revoked, `caducado` expired), names, key type, expiry and serial. Private keys are never shown.

## origin-certs create

```text
origin-certs create <zone> <name>… --cert-out <file|-> [--key-out <file|->] [--key-type ecdsa|rsa] [--days N] [--csr <file>] --reason "…"
```

Issues a certificate for one or more names: the zone itself, names below it, or wildcards `*.name`. The API checks the request first; after you confirm, the certificate is issued and written.

| Option | Meaning |
|---|---|
| `--cert-out <file\|->` | **Required.** New file for the certificate followed by the Origin CA (PEM); `-` writes to standard output. |
| `--key-out <file\|->` | **Required without `--csr`.** New file for the private key, created with mode `0600`; `-` writes to standard output. OpenWAF generates the key, hands it over once and does not keep it. |
| `--key-type ecdsa\|rsa` | Key OpenWAF generates: `ecdsa` (P-256, default) or `rsa` (2048 bits). Ignored with `--csr`. |
| `--days N` | Validity: `7`, `30`, `90`, `365`, `730`, `1095` or `5475` (15 years, the default). |
| `--csr <file>` | A PEM certificate request made on the origin. The key never leaves your server; `--key-out` is then not allowed. |

The CLI never overwrites a file: if `--cert-out` or `--key-out` exists, it stops before calling the API. `--cert-out` and `--key-out` cannot both be `-`.

```sh
openwaf-cloud ctl origin-certs create example.com example.com '*.example.com' \
  --cert-out origin.pem --key-out origin.key --reason "New origin server"
```

Install both files on the origin, then set the zone (or the name) to `origin.tls_verify=full_strict` with [`zones set`](https://developers.openwaf.dev/cli/reference/zones/#zones-set).

## origin-certs revoke

```text
origin-certs revoke <zone> <id> --reason "…"
```

Revokes an origin certificate (id from `origin-certs list`). Edge nodes reject it in `full_strict` from their next configuration, so an origin still serving it gets `526` errors. Revoking an already revoked certificate does nothing.

## origin-tls status

```text
origin-tls status <zone> [--json]
```

For each proxied name: its origin, the TLS mode (`full` encrypts without verifying, `full_strict` verifies), the name verified, whether the edge presents its client certificate (mTLS) and whether the origin asks for one, what a check from the control plane sees on the origin (certificate expiry and who it is trusted by) and the edge's `525`/`526` errors in the last 24 hours. The check is cached for 60 seconds.

## origin-tls ca

```text
origin-tls ca [--client]
```

Prints a public CA bundle in PEM. Needs no token.

| Option | Meaning |
|---|---|
| (none) | The OpenWAF Origin CA: what the edge trusts, besides public CAs, in `full_strict`. |
| `--client` | The edge's client CA: what your origin must trust if it requires the edge's client certificate. |

```sh
openwaf-cloud ctl origin-tls ca --client > openwaf-edge-client-ca.pem
```