Install an origin certificate

After you issue an origin certificate, install it on the server the edge connects to. In the examples, origin.pem is the certificate (optionally followed by the Origin CA certificate) and origin.key its private key.

#Which name the server must present

The server must present this certificate for the name the edge verifies, as described in The verified name (SNI). When the origin is an IP address, the edge sends the site's name in SNI (for example www.example.com), so the server block that matches that name, or the default one, must use this certificate.

#Configure your server

server {
    listen 443 ssl;
    server_name example.com *.example.com;
    ssl_certificate     /etc/nginx/tls/origin.pem;
    ssl_certificate_key /etc/nginx/tls/origin.key;
    # …
}

example.com, *.example.com {
    tls /etc/caddy/tls/origin.pem /etc/caddy/tls/origin.key
    reverse_proxy 127.0.0.1:8080
}

<VirtualHost *:443>
    ServerName example.com
    ServerAlias *.example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/openwaf/origin.pem
    SSLCertificateKeyFile /etc/ssl/openwaf/origin.key
</VirtualHost>

tls:
  certificates:
    - certFile: /certs/origin.pem
      keyFile: /certs/origin.key

#Check and switch

#Renew before expiry

Origin certificates don't renew themselves. Before one expires, issue a new certificate, install it, check the status and then revoke the old one. The origin status shows the days left for each name's certificate.