The OpenWAF Origin CA is a certificate authority run by OpenWAF that issues free certificates for your origin servers. The OpenWAF edge trusts it in Full (strict) alongside the public CAs. Browsers don't trust it, and they never need to: visitors only ever see the edge certificate.
Use an origin certificate when:
- the origin has no public certificate, or you don't want to renew one every few months;
- the name the edge verifies doesn't resolve to the origin, or the origin isn't reachable from the Internet, so a public CA can't validate it.
What you can request
| Field | Rules | Default |
|---|---|---|
Names (hostnames) | 1–100 names: the zone itself, names below it (www.example.com) or wildcards *.<name> (*.example.com, *.shop.example.com). Nothing outside the zone and no IP addresses. Names are lower-cased and de-duplicated. | — |
Key (key_type) | ecdsa_p256 or rsa2048, generated by OpenWAF, or your own CSR (csr). | ecdsa_p256 |
CSR (csr) | A PEM certificate request made on your server, with an ECDSA P-256/P-384 or RSA 2048–8192 key. Only its public key is used: its subject and extensions are ignored and the names come from hostnames. | — |
Validity (validity_days) | 7, 30, 90, 365, 730, 1095 or 5475 days. | 5475 (15 years) |
The certificate carries the names as DNS subject alternative names, the serverAuth extended key usage, a random 128-bit serial number and the first name as its common name.
The private key is shown once
When OpenWAF generates the key, it is returned only in the answer that issues the certificate. OpenWAF doesn't store it or write it to any log, including the audit log. Save it straight away; if you lose it, issue another certificate and revoke the old one.
With a CSR, no private key is generated and yours never leaves your server. This is the safer option.
Issue a certificate
You need the tech or admin role; readonly can list certificates.
- Go to SSL/TLS › Origin › Origin certificates and select Create certificate.
- Enter the names, one per line.
- Under Private key, choose Generate an ECDSA P-256 key (recommended), Generate an RSA 2048 key or Use my own CSR, and pick a Validity.
- Select Create, then copy or download the certificate and the key. They can't be shown again.
# Key generated by OpenWAF, written to a 0600 file and never printed:
openwaf-cloud ctl origin-certs create example.com example.com '*.example.com' \
--cert-out origin.pem --key-out origin.key --reason "origin certificate"
# RSA key, valid for one year:
openwaf-cloud ctl origin-certs create example.com www.example.com --key-type rsa --days 365 \
--cert-out origin.pem --key-out origin.key --reason "origin certificate"
# With a CSR: the key stays on your server.
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
-keyout origin.key -out origin.csr -subj "/CN=example.com"
openwaf-cloud ctl origin-certs create example.com example.com '*.example.com' --csr origin.csr \
--cert-out origin.pem --reason "origin certificate"--cert-out receives the certificate followed by the Origin CA certificate. Existing files are never overwritten. Like every change, the command simulates first and asks for confirmation (--yes without a terminal, --dry-run only checks).
curl -s -X POST https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/origin-certs \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: application/json" \
-H "X-Change-Reason: origin certificate" \
-d '{"hostnames": ["example.com", "*.example.com"], "key_type": "ecdsa_p256", "validity_days": 5475}'The answer is 201 with certificate (its metadata), certificate_pem, private_key_pem (absent with a csr) and ca_pem, sent with Cache-Control: no-store. Add ?dry_run=1 to validate without issuing. Validation errors are 422 with code invalid and the offending field (hostnames, key_type, validity_days or csr).
create_origin_cert works in two steps: confirm=false checks the request, confirm=true issues. Prefer passing a csr, so no private key goes through the conversation.
{"zone": "example.com", "hostnames": ["example.com", "*.example.com"], "csr": "-----BEGIN CERTIFICATE REQUEST-----\n…", "reason": "origin certificate", "confirm": false}Next: install the certificate on your server.
List certificates
Each certificate has a status: active, revoked or expired, plus its names, key type, serial, SHA-256 fingerprint and validity. Keys are never included.
SSL/TLS › Origin › Origin certificates.
openwaf-cloud ctl origin-certs list example.comcurl -s https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/origin-certs \
-H "Authorization: Bearer $OPENWAF_TOKEN"list_origin_certs with {"zone": "example.com"}.
Revoke a certificate
Revoke a certificate whose key may have leaked or that you no longer use. The edge nodes receive the revocation with their next configuration, usually within a minute, and from then on reject the certificate in Full (strict): an origin still serving it answers 526. Revocation can't be undone; issue a new certificate instead. The certificate stays in the list with status revoked, who revoked it and when.
In SSL/TLS › Origin › Origin certificates, select Revoke on the certificate and confirm.
openwaf-cloud ctl origin-certs revoke example.com <id> --reason "key leaked"curl -s -X DELETE https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/origin-certs/$CERT_ID \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "X-Change-Reason: key leaked"The call is idempotent. A certificate of another zone or organization answers 404.
revoke_origin_cert with the certificate id from list_origin_certs: confirm=false shows the certificate, confirm=true revokes it.
Certificates of a deleted zone count as revoked, even if another organization adds the same domain later.
Download the Origin CA certificate
The Origin CA certificate is public. You don't need it on a server that only talks to the OpenWAF edge, but some tools want the full chain:
curl -fsS https://dash.openwaf.dev/v1/origin-tls/origin-ca.pem -o openwaf-origin-ca.pem
# or
openwaf-cloud ctl origin-tls caThe URL returns every unexpired Origin CA certificate; during a rotation there is more than one.
Audit and history
Issuing and revoking are recorded in the organization's audit log (zone.origin_cert.issue, zone.origin_cert.revoke) with the names, the serial and the reason. Origin certificates live on your server, not in the zone configuration, so they don't create zone versions and reverting a version doesn't touch them.