Authenticated origin pulls (mTLS)

Make the edge present a client certificate so your origin accepts only connections that come through OpenWAF.

With Require the edge certificate on, the edge presents a TLS client certificate when your origin asks for one. Your server then requires a client certificate signed by the OpenWAF Edge Client CA and refuses every other connection, including attackers who found your origin's IP address.

How it works

Each edge node has its own client certificate (ECDSA P-256, valid for 30 days), issued by the OpenWAF Edge Client CA and renewed automatically well before it expires.
The edge presents it only for sites with origin.client_cert set to true, and only when the origin requests a client certificate.
The Edge Client CA is shared by the whole platform. A valid client certificate proves "this connection comes from the OpenWAF edge", not "it comes for my zone". Combine it with the Host header and SNI checks on your server and, if you need more, your own authentication.

Set it up

Turn the option on and wait for it to propagate.
In SSL/TLS › Origin › Require the edge certificate, turn on Present the edge client certificate and Save changes. Check Changes › Propagation until every node applied the new version.
```
openwaf-cloud ctl zones set example.com origin.client_cert:=true --reason "mTLS to the origin" --wait
```
--wait returns when every node has applied the new version.
```
curl -s -X PATCH https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/edge \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Change-Reason: mTLS to the origin" \
  -d '{"origin": {"client_cert": true}}'
```
update_settings with {"zone": "example.com", "settings": {"origin": {"client_cert": true}}, "reason": "mTLS to the origin"}, first with confirm=false, then confirm=true. Check zone_propagation afterwards.

Download the Edge Client CA to your server:

curl -fsS https://dash.openwaf.dev/v1/origin-tls/edge-client-ca.pem -o openwaf-edge-client-ca.pem
# or: openwaf-cloud ctl origin-tls ca --client > openwaf-edge-client-ca.pem

The dashboard offers the same file under Download the Edge Client CA (PEM).

Require client certificates on the server (examples below) and reload it.
Check. In the origin status, the name shows mTLS and no 525 errors appear. From outside the edge, a connection without a client certificate must fail:
```
curl -sv https://203.0.113.10/ -H 'Host: www.example.com' -k -o /dev/null
```

Server examples

/etc/nginx/conf.d/example.com.conf

server {
    listen 443 ssl;
    ssl_certificate        /etc/nginx/tls/origin.pem;
    ssl_certificate_key    /etc/nginx/tls/origin.key;
    # Only connections from the OpenWAF edge
    ssl_client_certificate /etc/nginx/tls/openwaf-edge-client-ca.pem;
    ssl_verify_client      on;
    ssl_verify_depth       1;
}

Caddyfile

example.com {
    tls /etc/caddy/tls/origin.pem /etc/caddy/tls/origin.key {
        client_auth {
            mode require_and_verify
            trust_pool file /etc/caddy/tls/openwaf-edge-client-ca.pem
        }
    }
    reverse_proxy 127.0.0.1:8080
}

Before Caddy 2.8, use trusted_ca_cert_file /etc/caddy/tls/openwaf-edge-client-ca.pem instead of trust_pool.

/etc/apache2/sites-available/example.com.conf

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/openwaf/origin.pem
    SSLCertificateKeyFile /etc/ssl/openwaf/origin.key
    SSLCACertificateFile  /etc/ssl/openwaf/openwaf-edge-client-ca.pem
    SSLVerifyClient require
    SSLVerifyDepth  1
</VirtualHost>

dynamic.yml

tls:
  options:
    openwaf-edge:
      clientAuth:
        caFiles:
          - /certs/openwaf-edge-client-ca.pem
        clientAuthType: RequireAndVerifyClientCert
http:
  routers:
    example:
      rule: Host(`example.com`)
      tls:
        options: openwaf-edge@file
      service: example

With Docker labels: traefik.http.routers.example.tls.options=openwaf-edge@file.

Keep the CA up to date

When the Edge Client CA rotates, the download URL returns both the old and the new CA while both are valid. Download it again regularly; a daily scheduled curl is enough.

Authenticated origin pulls (mTLS)

#How it works

#Set it up

#Server examples

#Keep the CA up to date

#Related

How it works

Set it up

Server examples

Keep the CA up to date

Related