# Install an origin certificate

> Install an OpenWAF Origin CA certificate on nginx, Caddy, Apache or Traefik so the edge can verify your origin in Full (strict).

After you [issue an origin certificate](https://developers.openwaf.dev/ssl/origin-ca/#issue), install it on the server the edge connects to. In the examples, `origin.pem` is the certificate (optionally followed by the Origin CA certificate) and `origin.key` its private key.

## Which name the server must present

The server must present this certificate for the name the edge verifies, as described in [The verified name (SNI)](https://developers.openwaf.dev/ssl/origin-tls/#server-name). When the origin is an IP address, the edge sends the **site's name** in SNI (for example `www.example.com`), so the server block that matches that name, or the default one, must use this certificate.

## Configure your server

**nginx**

```nginx
server {
    listen 443 ssl;
    server_name example.com *.example.com;
    ssl_certificate     /etc/nginx/tls/origin.pem;
    ssl_certificate_key /etc/nginx/tls/origin.key;
    # …
}
```

Reload with `nginx -s reload`.

**Caddy**

```text
example.com, *.example.com {
    tls /etc/caddy/tls/origin.pem /etc/caddy/tls/origin.key
    reverse_proxy 127.0.0.1:8080
}
```

Reload with `caddy reload`.

**Apache**

```text
<VirtualHost *:443>
    ServerName example.com
    ServerAlias *.example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/openwaf/origin.pem
    SSLCertificateKeyFile /etc/ssl/openwaf/origin.key
</VirtualHost>
```

Requires `mod_ssl`. Reload with `apachectl graceful`.

**Traefik**

```yaml
tls:
  certificates:
    - certFile: /certs/origin.pem
      keyFile: /certs/origin.key
```

Traefik picks the certificate by SNI among the ones it has loaded. The router must have TLS enabled (`tls: {}`, or `tls=true` in Docker labels).


> **Note**
>
> Keep the private key readable only by the web server (`chmod 600`). The CLI already writes `--key-out` files with mode `0600`.


## Check and switch

1. Reload the server.
2. Check the origin status. In **SSL/TLS › Origin › Origin status**, select **Check again**: the name should show **OK**, trusted by the OpenWAF Origin CA.

   ```sh
   openwaf-cloud ctl origin-tls status example.com
   ```

   The result is cached for 60 seconds per zone.
3. If the zone isn't in Full (strict) yet, switch it: see [Move to Full (strict)](https://developers.openwaf.dev/ssl/full-strict/).


## Renew before expiry

Origin certificates don't renew themselves. Before one expires, issue a new certificate, install it, check the status and then revoke the old one. The origin status shows the days left for each name's certificate.