New zones start in Full (strict). Older zones may still be in Full, where the edge encrypts but accepts any origin certificate. This guide switches them safely: check first, fix what would fail, then switch.
Check the origin status
The origin status shows, for every proxied HTTPS name, what the edge would find with Full (strict). It's measured with a TLS handshake only (no HTTP request), takes at most 5 seconds per origin and is cached for 60 seconds per zone.
Go to SSL/TLS › Origin › Origin status and select Check again.
openwaf-cloud ctl origin-tls status example.comcurl -s https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/origin-tls/status \
-H "Authorization: Bearer $OPENWAF_TOKEN"origin_tls_status with {"zone": "example.com"}.
Each name has a probe.state:
| State | Dashboard | Meaning |
|---|---|---|
ok | OK | The certificate would pass Full (strict). trusted_by says whether a public CA or the origin_ca vouches for it. |
invalid | Invalid certificate | It would fail; error says why (expired, name mismatch, unknown authority, revoked). Marked Would fail with Full (strict) (526). |
unreachable | Unreachable | The check couldn't connect. |
http | HTTP (not encrypted) | The origin uses http; TLS modes don't apply. |
skipped | Not checked | The origin resolves to a private, loopback or link-local address, which the check never connects to. |
The status also shows each name's mode, effective_server_name (the name that would be verified), whether the origin asks for a client certificate, the certificate's expiry, and the edge's 525/526 errors in the last 24 hours with the latest one.
Switch safely
Fix every name that isn't
ok. Install a certificate from a public CA or a free OpenWAF Origin CA certificate. If the certificate is for a different name than the verified one, setorigin.server_name(SSL/TLS › Origin › Advanced › Origin TLS name (SNI)).Check again until every name you are switching is
ok.Switch the mode, for the whole zone or one name first.
In SSL/TLS › Origin › Origin encryption, choose Full (strict). Use Scope to apply it to the whole domain or to a single name, then Save changes with a reason.
# Whole zone: openwaf-cloud ctl zones set example.com origin.tls_verify=full_strict --reason "origin has a valid certificate" # One name only: openwaf-cloud ctl zones set example.com --host www.example.com origin.tls_verify=full_strict --reason "www first"curl -s -X PATCH https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/edge \ -H "Authorization: Bearer $OPENWAF_TOKEN" \ -H "Content-Type: application/json" \ -H "X-Change-Reason: origin has a valid certificate" \ -d '{"origin": {"tls_verify": "full_strict"}}'For one name:
{"hosts": {"www.example.com": {"origin": {"tls_verify": "full_strict"}}}}. Add?dry_run=1to see the change without applying it.update_settingssimulates withconfirm=falseand returns the diff andcurrent_version; repeat withconfirm=trueandexpected_version.{"zone": "example.com", "settings": {"origin": {"tls_verify": "full_strict"}}, "reason": "origin has a valid certificate", "confirm": false}Watch for 526 errors in the origin status (errors in the last 24 hours) or in security events. If something breaks, switch back to
fullor revert the zone version.