Authenticated Origin Pulls (mTLS)

Authenticated Origin Pulls helps ensure requests to your origin server come from the Cloudflare network, which provides an additional layer of security on top of Full or Full (strict) encryption modes.

This authentication becomes particularly important with the Cloudflare Web Application Firewall (WAF). Together with the WAF, you can make sure that all traffic is evaluated before receiving a response from your origin server.

​​ Availability

​​ Aspects to consider

Although Cloudflare provides you a certificate to easily configure zone-level authenticated origin pulls, this certificate is not exclusive to your account and only guarantees that a request is coming from the Cloudflare network. If you want more strict security, you should consider additional security measures for your origin and upload your own certificate when setting up Authenticated Origin Pulls.

Using a custom certificate is possible with both zone-level and per-hostname authenticated origin pulls and is required if you need your domain to be FIPS Open external link compliant.

​​ Limitations

Authenticated Origin Pulls does not apply when your SSL/TLS encryption mode is set to Off or Flexible.

​​ Related topics

• SSL/TLS Encryption Modes
• Cloudflare Tunnel