# Get started with SSL/TLS

> Check that every proxied name has a valid certificate, verify the connection to your origin and turn on HSTS.

HTTPS at the edge works as soon as a name is proxied: you don't upload or renew anything. What you decide is how the edge talks to your origin. This guide takes a zone from "proxied" to "encrypted and verified end to end".

## Before you begin

- A zone in OpenWAF with at least one proxied `A`, `AAAA` or `CNAME` record. See [DNS](https://developers.openwaf.dev/dns/).
- For a delegated zone, the delegation to the OpenWAF name servers must be active. For an external zone, each proxied name must point at the edge (`CNAME` to `edge.openwaf.dev`).
- A `tech` or `admin` role to change settings (any role can read them).

## Steps

1. **Check the edge certificates.** Open **SSL/TLS › Certificates**. Every proxied name is listed under **Sites** with its state. *Valid* means a certificate is serving it; *Pending* means issuance is in progress, which usually takes a few minutes after delegation.

   ```sh
   openwaf-cloud ctl certs list example.com
   ```

2. **Check what your origin presents.** Open **SSL/TLS › Origin** and look at **Origin status**. For each proxied name it shows whether your server's certificate would pass Full (strict) verification. A name marked *Would fail with Full (strict) (526)* needs a valid certificate first.

   ```sh
   openwaf-cloud ctl origin-tls status example.com
   ```

3. **Fix the origin certificate if needed.** Install a certificate from a public CA, or create a free one from the OpenWAF Origin CA in **SSL/TLS › Origin › Create certificate** and [install it on your server](https://developers.openwaf.dev/ssl/install-origin-certificate/).

4. **Use Full (strict).** New zones already use it. For an older zone in *Full*, follow [Move to Full (strict)](https://developers.openwaf.dev/ssl/full-strict/).

5. **Turn on HSTS when everything works over HTTPS.** In **SSL/TLS › Certificates › HSTS**, start with a short duration such as 1 day and raise it later. See [HSTS](https://developers.openwaf.dev/ssl/hsts/).


> **Tip**
>
> Want your server to accept only connections from OpenWAF? After Full (strict) works, set up [authenticated origin pulls](https://developers.openwaf.dev/ssl/authenticated-origin-pulls/).


## Next steps

- [Edge certificates](https://developers.openwaf.dev/ssl/edge-certificates/): issuance, renewal and what the states mean.
- [Origin TLS modes](https://developers.openwaf.dev/ssl/origin-tls/): what each mode verifies and which name it checks.
- [Troubleshooting](https://developers.openwaf.dev/ssl/troubleshooting/): what to do about 525, 526 or a failed certificate.