The edge terminates the visitor's TLS connection and opens a second connection to your server, the origin. These settings decide how that second connection is made and how much the edge trusts it.
Origin address and scheme
For each proxied name, the edge builds the origin address from the record's content:
<origin.scheme>://<record content>[:<origin.port>]A site whose A record points to 203.0.113.10 is fetched from https://203.0.113.10. With origin.port 9443 it becomes https://203.0.113.10:9443.
| Setting | Values | Default |
|---|---|---|
origin.scheme | https or http | https |
origin.port | 0–65535; 0 = the scheme's port (443 or 80) | 0 |
Full and Full (strict)
Both modes encrypt the connection. They differ in what the edge checks:
| Mode | origin.tls_verify | What the edge does | Risk |
|---|---|---|---|
| Full | full | Encrypts, but accepts any certificate: self-signed, expired or for another name. | Anyone who can intercept traffic between the edge and your server can impersonate the origin. |
| Full (strict) | full_strict | Encrypts and verifies the certificate. If verification fails, the visitor gets a 526 and nothing from the origin is served. | None of the above; the origin needs a valid certificate. |
What Full (strict) verifies
- The chain leads to a public root CA trusted by the operating system or to the OpenWAF Origin CA.
- The certificate is within its validity dates.
- The certificate is valid for the verified name.
- It isn't revoked. The edge rejects OpenWAF Origin CA certificates that were revoked, and those of deleted zones, until they expire.
Defaults
- New zones use
full_strict. - Zones created before Full (strict) existed kept
full, so nothing changed for them. Switch them with Move to Full (strict).
The verified name (SNI)
In Full (strict), the edge checks the certificate against one name and also sends it in SNI. It picks, in this order:
origin.server_name, when set. Use it when the origin is203.0.113.7but its certificate is fororigin.example.com.- The origin's host name, when the origin is a name:
https://backend.example.com:9443→backend.example.com. - The site's own name, when the origin is an IP address:
www.example.comwith anArecord to203.0.113.7→www.example.com.
In Full, origin.server_name only changes the SNI; without it, the edge sends the origin's host name, or no SNI for an IP address.
origin.server_name must be empty or a lower-case host name, without a wildcard and not an IP address.
Per-name settings
Every origin.* setting can be set for the whole zone or for one name under hosts.<name>.origin. A name's value replaces the zone's for that name only; unset it to inherit again. See Per-name settings.
openwaf-cloud ctl zones set example.com --host api.example.com origin.tls_verify=full_strict --reason "api origin has a valid certificate"Related
- Move to Full (strict)
- Authenticated origin pulls: the edge proves it's OpenWAF to your server.
- Troubleshooting 525 and 526