Authenticated Origin Pulls on Cloudflare

Authenticated Origin Pulls, which Cloudflare also calls mTLS, is the mechanism that lets your origin server prove a connection really comes from the Cloudflare network before it serves any traffic. On its own, moving a site behind an orange-cloud proxy hides the origin IP, but the origin will still answer anyone who finds that IP directly. Authenticated Origin Pulls closes that gap by requiring the incoming connection to present a client certificate Cloudflare holds.

Why it helps

The advantage is that your origin stops being reachable by anyone who obtains its IP. Even a port scanner or a leaked DNS record cannot get past the origin unless the request carries the correct client certificate. Combined with blocking direct access at the firewall, it effectively reduces your attack surface to the Cloudflare network alone.

Authenticated Origin Pulls requires your SSL mode to be Full or steeper. It does not apply when encryption is set to Off or Flexible, and it is not relevant to origins reached through Cloudflare Tunnel, because a tunnel already authenticates the connection and exposes no inbound listener for Cloudflare to present a certificate to.

How it works

There are three levels, each with its own certificate and enablement:

• Global uses a Cloudflare-provided certificate shared across all accounts and simply proves the request came from the Cloudflare network.
• Zone-level uses a certificate you upload and proves the request came from your zone through the Cloudflare network. It takes precedence over global.
• Per-hostname uses a certificate you upload and applies only to specific hostnames. It takes precedence over the other two for those hostnames.

For meaningful security, use zone-level or per-hostname with your own certificate, because global only proves Cloudflare, not your account.

Setup on the origin

For a zone-level setup with NGINX as the origin, generate a client certificate and its CA, upload the leaf certificate to Cloudflare in the Origin Server area under Authenticated Origin Pulls, and then configure the origin to verify the client certificate the connection presents.

ssl_client_certificate /etc/nginx/certs/origin-pull-ca.pem;
ssl_verify_client on;

On Apache the equivalent directives are SSLCACertificateFile followed by SSLVerifyClient require in the virtual host. The exact CA file is the root that signs the client certificate you uploaded, so the origin can verify Cloudflare's presented certificate against it.

To enforce it, the origin must require, not merely request, a client certificate. During cutover it is common to first set the directive to optional, confirm legitimate traffic passes, then tighten it to required. If you enforce before traffic is proven, or the Cloudflare feature is not yet enabled, legitimate requests get rejected with a handshake or 525-style failure. See Cloudflare SSL modes for the mode this depends on and 525 SSL handshake for what a client-certificate rejection can look like.