Do I need to upload or renew a certificate for my site?
No. Every proxied name gets a Let's Encrypt certificate that OpenWAF renews automatically. See Edge certificates.
Can I upload my own certificate for the edge?
Not self-service. Certificates shown as Uploaded by an operator are installed by OpenWAF; if you need one, contact [email protected]. OpenWAF never replaces such a certificate with an automatic one.
Do browsers trust OpenWAF Origin CA certificates?
No, only the OpenWAF edge does. Visitors always see the edge certificate, so an origin behind the proxy doesn't need a publicly trusted one. Don't use origin certificates on servers that visitors reach directly. See OpenWAF Origin CA.
I lost the private key of an origin certificate. Can I download it again?
No. OpenWAF never stores generated keys. Issue a new certificate, install it and revoke the old one. To avoid the problem, issue with a CSR so the key never leaves your server.
Can my origin keep a Let's Encrypt certificate instead?
Yes. Full (strict) accepts any certificate that chains to a public root CA, is in date, isn't revoked and is valid for the verified name.
My origin is an IP address. Which name does its certificate need?
The site's own name, for example www.example.com, unless you set origin.server_name. See The verified name (SNI).
Does Full (strict) apply to origins over HTTP?
No. With origin.scheme http the connection isn't encrypted and the TLS modes, the verified name and mTLS don't apply.
Does the edge client certificate prove a request is for my zone?
No. The Edge Client CA is shared by the whole platform: it proves the connection comes from the OpenWAF edge. Keep checking Host and SNI on your server. See Authenticated origin pulls.
Does reverting a zone version undo an origin certificate?
No. Issuing and revoking origin certificates are recorded in the audit log but aren't part of the zone configuration, so reverting a version doesn't touch them.