Full (strict), OpenWAF Origin CA and authenticated origin pulls
Origin TLS is now set per name: full encrypts without verifying, full_strict verifies the origin's certificate. New domains start in full_strict; existing ones stay in full. The OpenWAF Origin CA issues free origin certificates valid for up to 15 years, from a key it generates (returned once, never kept) or from your own CSR. With authenticated origin pulls the edge presents a client certificate, so your server can refuse every connection that does not come through OpenWAF.
See the SSL/TLS documentation.