# Origin TLS modes

> How the edge connects to your origin over HTTP or HTTPS, what Full and Full (strict) verify, and which name it checks.

The edge terminates the visitor's TLS connection and opens a second connection to your server, the **origin**. These settings decide how that second connection is made and how much the edge trusts it.

## Origin address and scheme

For each proxied name, the edge builds the origin address from the record's content:

```text
<origin.scheme>://<record content>[:<origin.port>]
```

A site whose `A` record points to `203.0.113.10` is fetched from `https://203.0.113.10`. With `origin.port` `9443` it becomes `https://203.0.113.10:9443`.

| Setting | Values | Default |
|---|---|---|
| `origin.scheme` | `https` or `http` | `https` |
| `origin.port` | `0`–`65535`; `0` = the scheme's port (443 or 80) | `0` |

> **Caution**
>
> With `http`, traffic between the edge and your server isn't encrypted and the TLS modes below don't apply. Use it only on a private network or when the server can't serve HTTPS.


## Full and Full (strict)

Both modes encrypt the connection. They differ in what the edge checks:

| Mode | `origin.tls_verify` | What the edge does | Risk |
|---|---|---|---|
| **Full** | `full` | Encrypts, but accepts **any** certificate: self-signed, expired or for another name. | Anyone who can intercept traffic between the edge and your server can impersonate the origin. |
| **Full (strict)** | `full_strict` | Encrypts and **verifies** the certificate. If verification fails, the visitor gets a `526` and nothing from the origin is served. | None of the above; the origin needs a valid certificate. |

### What Full (strict) verifies

- The chain leads to a **public root CA** trusted by the operating system **or** to the [OpenWAF Origin CA](https://developers.openwaf.dev/ssl/origin-ca/).
- The certificate is within its validity dates.
- The certificate is valid for the [verified name](#server-name).
- It isn't revoked. The edge rejects OpenWAF Origin CA certificates that were revoked, and those of deleted zones, until they expire.

### Defaults

- **New zones** use `full_strict`.
- Zones created before Full (strict) existed kept `full`, so nothing changed for them. Switch them with [Move to Full (strict)](https://developers.openwaf.dev/ssl/full-strict/).

## The verified name (SNI)

In Full (strict), the edge checks the certificate against one name and also sends it in SNI. It picks, in this order:

1. `origin.server_name`, when set. Use it when the origin is `203.0.113.7` but its certificate is for `origin.example.com`.
2. The origin's host name, when the origin is a name: `https://backend.example.com:9443` → `backend.example.com`.
3. The **site's own name**, when the origin is an IP address: `www.example.com` with an `A` record to `203.0.113.7` → `www.example.com`.

In Full, `origin.server_name` only changes the SNI; without it, the edge sends the origin's host name, or no SNI for an IP address.

`origin.server_name` must be empty or a lower-case host name, without a wildcard and not an IP address.

## Per-name settings

Every `origin.*` setting can be set for the whole zone or for one name under `hosts.<name>.origin`. A name's value replaces the zone's for that name only; unset it to inherit again. See [Per-name settings](https://developers.openwaf.dev/rules/per-name-settings/).

```sh
openwaf-cloud ctl zones set example.com --host api.example.com origin.tls_verify=full_strict --reason "api origin has a valid certificate"
```

## Related

- [Move to Full (strict)](https://developers.openwaf.dev/ssl/full-strict/)
- [Authenticated origin pulls](https://developers.openwaf.dev/ssl/authenticated-origin-pulls/): the edge proves it's OpenWAF to your server.
- [Troubleshooting 525 and 526](https://developers.openwaf.dev/ssl/troubleshooting/)