HTTPS at the edge works as soon as a name is proxied: you don't upload or renew anything. What you decide is how the edge talks to your origin. This guide takes a zone from "proxied" to "encrypted and verified end to end".
Before you begin
- A zone in OpenWAF with at least one proxied
A,AAAAorCNAMErecord. See DNS. - For a delegated zone, the delegation to the OpenWAF name servers must be active. For an external zone, each proxied name must point at the edge (
CNAMEtoedge.openwaf.dev). - A
techoradminrole to change settings (any role can read them).
Steps
Check the edge certificates. Open SSL/TLS › Certificates. Every proxied name is listed under Sites with its state. Valid means a certificate is serving it; Pending means issuance is in progress, which usually takes a few minutes after delegation.
openwaf-cloud ctl certs list example.comCheck what your origin presents. Open SSL/TLS › Origin and look at Origin status. For each proxied name it shows whether your server's certificate would pass Full (strict) verification. A name marked Would fail with Full (strict) (526) needs a valid certificate first.
openwaf-cloud ctl origin-tls status example.comFix the origin certificate if needed. Install a certificate from a public CA, or create a free one from the OpenWAF Origin CA in SSL/TLS › Origin › Create certificate and install it on your server.
Use Full (strict). New zones already use it. For an older zone in Full, follow Move to Full (strict).
Turn on HSTS when everything works over HTTPS. In SSL/TLS › Certificates › HSTS, start with a short duration such as 1 day and raise it later. See HSTS.