OpenWAF encrypts both halves of every request to a proxied site. Visitors connect to the OpenWAF edge over HTTPS with a certificate that OpenWAF issues and renews for you. The edge then opens a second, separate connection to your server (the origin), and you choose how strictly it verifies that server's certificate.
visitor ──HTTPS (edge certificate)──▶ OpenWAF edge ──HTTPS (origin certificate)──▶ your originWhat you get
- Edge certificates without any work. Every proxied name gets a Let's Encrypt certificate, renewed well before it expires. The edge accepts TLS 1.2 and TLS 1.3 only, and plain HTTP requests are redirected to HTTPS.
- Verified encryption to the origin. In Full (strict) mode, the default for new zones, the edge checks the origin certificate's chain, dates, name and revocation status. If any check fails, visitors get a
526error and nothing from an unverified origin is served. - Free origin certificates. The OpenWAF Origin CA issues certificates for your servers, valid for up to 15 years. Only the OpenWAF edge trusts them, which is all a server behind the proxy needs.
- Authenticated origin pulls (mTLS). The edge can present a client certificate, so your server refuses every connection that doesn't come through OpenWAF.
- HSTS. Tell browsers to always use HTTPS for your sites.
Start here
Get startedcheck your edge certificates and secure the connection to your origin in a few minutes.Edge certificateshow certificates are issued and renewed for each proxied name.Origin TLS modesFull and Full (strict), and the name the edge verifies.OpenWAF Origin CAfree certificates for your origin servers.Install an origin certificatenginx, Caddy, Apache and Traefik examples.Move to Full (strict)switch an existing site without downtime.Authenticated origin pullslet only the OpenWAF edge reach your server.HSTSmake browsers use HTTPS every time.Settings referenceevery SSL/TLS setting with its default.Troubleshooting525 and 526 errors, pending and failed certificates.
Where to manage it
| Task | Dashboard | CLI | API | MCP |
|---|---|---|---|---|
| Edge certificate status | SSL/TLS › Certificates | certs list | GET …/zones/{zone}/certs | list_certificates |
| Origin mode, SNI name, mTLS | SSL/TLS › Origin | zones set | PATCH …/zones/{zone}/edge | update_settings |
| Origin status | SSL/TLS › Origin | origin-tls status | GET …/zones/{zone}/origin-tls/status | origin_tls_status |
| Origin certificates | SSL/TLS › Origin | origin-certs | …/zones/{zone}/origin-certs | create_origin_cert, list_origin_certs, revoke_origin_cert |
| HSTS | SSL/TLS › Certificates | zones set | PATCH …/zones/{zone}/edge | update_settings |
Setting changes are versioned like every other zone change: each one needs a reason, creates a new zone version and can be reverted. See Change control.