导航|地址|刷新
Authenticated Origin Pulls (mTLS)
图
Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ssl/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






SSL/TLS

/




Overview

Concepts

Get started


Edge certificates


Overview


Universal SSL


Overview

Enable Universal SSL certificates

Disable Universal SSL certificates

Alerts

Limitations

Troubleshooting






Advanced certificates


Overview

Manage advanced certificates

API commands






Custom certificates


Overview

Manage custom certificates

Renewal and expiration

Bundle methodologies

Remove key file password

Troubleshooting





Enforce HTTPS connections


Domain control validation (DCV)


Overview


Methods


Overview

Delegated

TXT

HTTP





Validation backoff schedule

Domain control validation flow

Troubleshooting






Geo Key ManagerBeta


Overview

Setup

Supported options





Add CAA records

Staging environmentBeta

Backup certificates

ECH ProtocolBeta


Additional options



Cipher suites


About


Customize cipher suites


Overview

Use the dashboard

Use the API





Security levels

Compliance standards

Supported cipher suites

Troubleshooting





Certificate Transparency MonitoringBeta

HTTP Strict Transport Security (HSTS)

Certificate Signing Requests (CSRs)

TLS 1.3

Minimum TLS Version

Automatic HTTPS Rewrites


Total TLS


Overview

Enable

Error messages





Always Use HTTPS

Opportunistic Encryption










Origin server



Encryption modes


Overview

Off (no encryption)

Flexible

Full

Full (strict)

Strict (SSL-Only Origin Pull)





Automatic key exchange to origins

SSL/TLS RecommenderDeprecated


Cloudflare origin CA


Setup

Troubleshooting






Authenticated Origin Pulls (mTLS)


Overview

About

AWS integration


Setup


Global

Zone-level

Per-hostname

Manage certificates

Rollback









Custom Origin Trust Store

Cipher suites






Client certificates (mTLS)


Overview

Create a client certificate

Enable mTLS

Bring your own CA (BYOCA)

Forward certificate to server

Label client certificates

Revoke a client certificate

Configure your mobile app or IoT device

Client certificate variables

Troubleshooting

mTLS for Zero Trust ↗





Cloudflare for SaaS ↗


Keyless SSL


Overview


Get started


Cloudflare Tunnel

Public DNS

Run with Docker






Hardware security modules


Overview

Configuration

AWS cloud HSM

Azure Dedicated HSM

Azure Managed HSM

Entrust nShield Connect

Fortanix DSM

Google Cloud HSM

IBM Cloud HSM

SoftHSMv2





Upgrade your key server


Reference


High availability

Scaling and benchmarking

Key server metrics

Keyless delegation





Glossary

Troubleshooting






Post-quantum


About PQC

PQC support

PQC in Cloudflare products

PQC to your origin

PQC and Cloudflare One






Reference


TLS protocols

Certificate and hostname priority

Certificate authorities

Browser compatibility


Migration guides


Entrust distrust

DigiCert G1 distrust





Rotate ACM certificate packs

Certificate pinning

Certificate statuses

Validity periods and renewal

Features and plans

Cloudflare and CVE-2019-1559

PCI compliance and vulnerabilities mitigation






Troubleshooting


Full resources list

General SSL errors

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

ERR_SSL_PROTOCOL_ERROR

ERR_TOO_MANY_REDIRECTS

Mixed content errors





FAQ

Changelog


Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

SSL/TLS llms.txt ↗

SSL/TLS llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/SSL/TLS

/Origin server

/Authenticated Origin Pulls (mTLS)



Authenticated Origin Pulls (mTLS)


Last updated Jun 24, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewAvailabilityConfiguration levelsWhen to use your own certificatePost-quantum certificatesRelated topics




Authenticated Origin Pulls (AOP) helps ensure requests to your origin server come from the Cloudflare network, which provides an additional layer of security on top of Full or Full (strict) encryption modes.


Check your encryption mode


Authenticated Origin Pulls does not apply when your SSL/TLS encryption mode is set to Off or Flexible.



Without AOP, anyone who discovers your origin server's IP address can send requests directly, bypassing Cloudflare and all its protections. When you combine AOP with the Cloudflare Web Application Firewall (WAF), your origin only accepts requests that have passed through Cloudflare, which means every request is evaluated by the WAF before reaching your server.


Availability


FreeProBusinessEnterprise

Availability

Yes

Yes

Yes

Yes



Configuration levels


AOP has three independent configuration levels. Each uses its own certificate and enablement setting, and each requires configuration on your origin server. Refer to the specific setup guides for details.


Global: Uses a Cloudflare-provided certificate that is shared across all Cloudflare accounts. Applies to all proxied traffic on the zone. This is the simplest setup but only guarantees that a request is coming from the Cloudflare network.



Zone-level: Uses a certificate that you upload. Applies to all proxied traffic on the zone. Provides stricter security because the certificate is exclusive to your account. Zone-level certificates take precedence over global certificates.



Per-hostname: Uses a certificate that you upload, applied to specific hostnames. Per-hostname certificates take precedence over zone-level and global certificates for the specified hostname.



Note


Global AOP, zone-level AOP, and per-hostname AOP are three independent configurations. Enabling or disabling one does not affect the others.




When to use your own certificate


Global AOP uses a Cloudflare-provided certificate shared across all accounts, so it only proves a request came from the Cloudflare network — not from your account specifically. If you need to guarantee requests come from your account, set up zone-level or per-hostname AOP with your own certificate.

Using your own certificate is also required for FIPS ↗ compliance. For broader origin protection guidance, refer to Protect your origin server.


Post-quantum certificates


Zone-level and per-hostname AOP support ML-DSA (FIPS 204) post-quantum client certificates. Refer to Post-quantum signatures for certificate generation and upload guidance.


Related topics


SSL/TLS Encryption Modes

Cloudflare Tunnel


PreviousTroubleshootingNextAbout


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Availability

Configuration levels

When to use your own certificate

Post-quantum certificates

Related topics


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址