# SSL/TLS

> Automatic HTTPS certificates at the edge, verified encryption to your origin, free origin certificates, mTLS and HSTS.

OpenWAF encrypts both halves of every request to a proxied site. Visitors connect to the OpenWAF edge over HTTPS with a certificate that OpenWAF issues and renews for you. The edge then opens a second, separate connection to your server (the **origin**), and you choose how strictly it verifies that server's certificate.

```text
visitor ──HTTPS (edge certificate)──▶ OpenWAF edge ──HTTPS (origin certificate)──▶ your origin
```

## What you get

- **Edge certificates without any work.** Every proxied name gets a Let's Encrypt certificate, renewed well before it expires. The edge accepts TLS 1.2 and TLS 1.3 only, and plain HTTP requests are redirected to HTTPS.
- **Verified encryption to the origin.** In *Full (strict)* mode, the default for new zones, the edge checks the origin certificate's chain, dates, name and revocation status. If any check fails, visitors get a `526` error and nothing from an unverified origin is served.
- **Free origin certificates.** The OpenWAF Origin CA issues certificates for your servers, valid for up to 15 years. Only the OpenWAF edge trusts them, which is all a server behind the proxy needs.
- **Authenticated origin pulls (mTLS).** The edge can present a client certificate, so your server refuses every connection that doesn't come through OpenWAF.
- **HSTS.** Tell browsers to always use HTTPS for your sites.

## Start here

- [Get started](https://developers.openwaf.dev/ssl/get-started/): check your edge certificates and secure the connection to your origin in a few minutes.
- [Edge certificates](https://developers.openwaf.dev/ssl/edge-certificates/): how certificates are issued and renewed for each proxied name.
- [Origin TLS modes](https://developers.openwaf.dev/ssl/origin-tls/): Full and Full (strict), and the name the edge verifies.
- [OpenWAF Origin CA](https://developers.openwaf.dev/ssl/origin-ca/): free certificates for your origin servers.
- [Install an origin certificate](https://developers.openwaf.dev/ssl/install-origin-certificate/): nginx, Caddy, Apache and Traefik examples.
- [Move to Full (strict)](https://developers.openwaf.dev/ssl/full-strict/): switch an existing site without downtime.
- [Authenticated origin pulls](https://developers.openwaf.dev/ssl/authenticated-origin-pulls/): let only the OpenWAF edge reach your server.
- [HSTS](https://developers.openwaf.dev/ssl/hsts/): make browsers use HTTPS every time.
- [Settings reference](https://developers.openwaf.dev/ssl/settings/): every SSL/TLS setting with its default.
- [Troubleshooting](https://developers.openwaf.dev/ssl/troubleshooting/): 525 and 526 errors, pending and failed certificates.


## Where to manage it

| Task | Dashboard | CLI | API | MCP |
|---|---|---|---|---|
| Edge certificate status | **SSL/TLS › Certificates** | `certs list` | `GET …/zones/{zone}/certs` | `list_certificates` |
| Origin mode, SNI name, mTLS | **SSL/TLS › Origin** | `zones set` | `PATCH …/zones/{zone}/edge` | `update_settings` |
| Origin status | **SSL/TLS › Origin** | `origin-tls status` | `GET …/zones/{zone}/origin-tls/status` | `origin_tls_status` |
| Origin certificates | **SSL/TLS › Origin** | `origin-certs` | `…/zones/{zone}/origin-certs` | `create_origin_cert`, `list_origin_certs`, `revoke_origin_cert` |
| HSTS | **SSL/TLS › Certificates** | `zones set` | `PATCH …/zones/{zone}/edge` | `update_settings` |

Setting changes are versioned like every other zone change: each one needs a reason, creates a new zone version and can be reverted. See [Change control](https://developers.openwaf.dev/change-control/).