Zone-level

import { AvailableNotifications, Render, Details, Tabs, TabItem, DashButton, } from "~/components";

When you enable zone-level Authenticated Origin Pulls (AOP), all proxied traffic to your zone is authenticated at the origin web server using a certificate that you upload. Unlike global AOP, which uses a Cloudflare-provided certificate shared across all accounts, zone-level AOP uses your own certificate for stricter security.

Global, zone-level, and per-hostname AOP are independent configurations. Enabling or disabling one does not affect the others.

Before you begin

Make sure your zone is using an SSL/TLS encryption mode of Full or higher.

:::caution

Zone-level AOP certificates are also applied to custom hostnames configured on a Cloudflare for SaaS zone. If you need a different AOP certificate for different custom hostnames, use per-hostname AOP.

:::

Zone-level AOP requires you to upload your own certificate. Refer to the steps below for an example of how to generate a custom certificate using OpenSSL. The CA root certificate that you use to issue the custom certificate should be the same CA that you will upload to your origin.

1. Upload your certificate to Cloudflare

1. Go to the Origin Server page.

2. Select the Authenticated Origin Pulls tab.

3. In the Zone-level section, select Upload certificate.

4. Paste the certificate and private key, then select Continue. :::note You must upload a leaf certificate. If you upload a root CA instead, the upload will fail. :::

5. Review your certificate details, save the certificate ID for future reference, and select Done.

Use the Upload a zone-level client certificate endpoint to upload your certificate.

:::note

You must upload a leaf certificate. If you upload a root CA instead, the API will return a missing leaf certificate error. :::

2. Upload the CA certificate to your origin

Upload the CA root certificate used to sign your client certificate to your origin server. Your origin will use this CA certificate to verify the client certificate presented by Cloudflare.

3. Configure origin to accept client certificates

<Render file="aop-configure-origin" product="ssl" params={{ one: " ", two: " ", }} />

4. Enable zone-level Authenticated Origin Pulls

1. Go to the Origin Server page.

2. Select the Authenticated Origin Pulls tab.

3. In the Zone-level section, switch the toggle to On.

Use the Set Enablement for Zone endpoint to enable zone-level Authenticated Origin Pulls.

:::caution

This endpoint is separate from the global AOP toggle, which uses the zone settings tls_client_auth setting. Make sure you use the correct endpoint for the configuration you intend.

:::

5. Enforce validation check on your origin

6. (Optional) Set up expiration alerts

You can configure alerts to receive notifications before your AOP certificates expire.

Further options

Refer to Manage certificates for further options.