# SSL/TLS FAQ

> Common questions about edge certificates, Full (strict), the OpenWAF Origin CA and mTLS.

**Do I need to upload or renew a certificate for my site?**

No. Every proxied name gets a Let's Encrypt certificate that OpenWAF renews automatically. See [Edge certificates](https://developers.openwaf.dev/ssl/edge-certificates/).


**Can I upload my own certificate for the edge?**

Not self-service. Certificates shown as **Uploaded by an operator** are installed by OpenWAF; if you need one, contact support@openwaf.dev. OpenWAF never replaces such a certificate with an automatic one.


**Do browsers trust OpenWAF Origin CA certificates?**

No, only the OpenWAF edge does. Visitors always see the edge certificate, so an origin behind the proxy doesn't need a publicly trusted one. Don't use origin certificates on servers that visitors reach directly. See [OpenWAF Origin CA](https://developers.openwaf.dev/ssl/origin-ca/).


**I lost the private key of an origin certificate. Can I download it again?**

No. OpenWAF never stores generated keys. Issue a new certificate, install it and revoke the old one. To avoid the problem, issue with a CSR so the key never leaves your server.


**Can my origin keep a Let's Encrypt certificate instead?**

Yes. Full (strict) accepts any certificate that chains to a public root CA, is in date, isn't revoked and is valid for the [verified name](https://developers.openwaf.dev/ssl/origin-tls/#server-name).


**My origin is an IP address. Which name does its certificate need?**

The site's own name, for example `www.example.com`, unless you set `origin.server_name`. See [The verified name (SNI)](https://developers.openwaf.dev/ssl/origin-tls/#server-name).


**Does Full (strict) apply to origins over HTTP?**

No. With `origin.scheme` `http` the connection isn't encrypted and the TLS modes, the verified name and mTLS don't apply.


**Does the edge client certificate prove a request is for my zone?**

No. The Edge Client CA is shared by the whole platform: it proves the connection comes from the OpenWAF edge. Keep checking `Host` and SNI on your server. See [Authenticated origin pulls](https://developers.openwaf.dev/ssl/authenticated-origin-pulls/).


**Does reverting a zone version undo an origin certificate?**

No. Issuing and revoking origin certificates are recorded in the audit log but aren't part of the zone configuration, so reverting a version doesn't touch them.