Per-hostname

import { AvailableNotifications, Render, Details, Tabs, TabItem, DashButton, } from "~/components";

When you enable per-hostname Authenticated Origin Pulls (AOP), all proxied traffic to the specified hostname is authenticated at the origin web server using a certificate that you upload. You can use client certificates from your Private PKI to authenticate connections from Cloudflare.

Global, zone-level, and per-hostname AOP are independent configurations. Enabling or disabling one does not affect the others. Per-hostname certificates take precedence over zone-level and global certificates for the specified hostname.

Before you begin

:::caution[Warning]

Refer to the steps below for an example of how to generate a custom certificate using OpenSSL. The CA root certificate that you use to issue the custom certificate should be the same CA that you will upload to your origin.

1. Upload custom certificate

1. Go to the Origin Server page.

2. Select the Authenticated Origin Pulls tab.

3. In the Per-hostname section, select Upload certificate.

4. Paste the certificate and private key, then select Continue. :::note You must upload a leaf certificate. If you upload a root CA instead, the upload will fail. :::

5. Review your certificate details, save the certificate ID for future reference, and select Continue.

6. On the Associate Hostnames page, enter the fully qualified domain name that should use this certificate and select Add for each one. You can also skip this step and associate hostnames later.

7. Select Save to confirm.

Use the Upload a Hostname Client Certificate endpoint to upload your custom certificate.

:::note

You must upload a leaf certificate. If you upload a root CA instead, the API will return a missing leaf certificate error. :::

In the API response, save the certificate id since it will be required in step 3.

2. Configure origin to accept client certificates

<Render file="aop-configure-origin" params={{ one: " ", two: " " }} product="ssl" />

3. Enable Authenticated Origin Pulls for the hostname

:::note For per-hostname AOP, the enablement happens as you associate a hostname. If you had already associated hostnames as you uploaded the certificate, you can skip this step. :::

1. Go to the Origin Server page.

2. Select the Authenticated Origin Pulls tab.

3. In the Per-hostname section, find the certificate that should be used and associate the hostname with it.

If you had set up logging on your origin during step 2, test and confirm that Authenticated Origin Pulls is working.

Use the Enable or Disable a Hostname for Client Authentication endpoint to enable Authenticated Origin Pulls for specific hostnames.

If you had set up logging on your origin during step 2, test and confirm that Authenticated Origin Pulls is working.

4. Enforce validation check on your origin

5. (Optional) Set up expiration alerts

You can configure alerts to receive notifications before your AOP certificates expire.

Further options

Refer to Manage certificates for further options.

To learn how to remove the configuration, refer to Rollback.