← Ssl / ssl / origin-configuration
Authenticated Origin Pulls (mTLS)
Authenticated Origin Pulls (AOP) helps ensure requests to your origin server come from the Cloudflare network, which provides an additional layer of security on top of Full or Full (strict) encryption modes.
Without AOP, anyone who discovers your origin server's IP address can send requests directly, bypassing Cloudflare and all its protections. When you combine AOP with the Cloudflare Web Application Firewall (WAF), your origin only accepts requests that have passed through Cloudflare, which means every request is evaluated by the WAF before reaching your server.
Availability
| Free | Pro | Business | Enterprise | |
|---|---|---|---|---|
| Availability | Yes | Yes | Yes | Yes |
Configuration levels
AOP has three independent configuration levels. Each uses its own certificate and enablement setting, and each requires configuration on your origin server. Refer to the specific setup guides for details.
-
Global: Uses a Cloudflare-provided certificate that is shared across all Cloudflare accounts. Applies to all proxied traffic on the zone. This is the simplest setup but only guarantees that a request is coming from the Cloudflare network.
-
Zone-level: Uses a certificate that you upload. Applies to all proxied traffic on the zone. Provides stricter security because the certificate is exclusive to your account. Zone-level certificates take precedence over global certificates.
-
Per-hostname: Uses a certificate that you upload, applied to specific hostnames. Per-hostname certificates take precedence over zone-level and global certificates for the specified hostname.
When to use your own certificate
Global AOP uses a Cloudflare-provided certificate shared across all accounts, so it only proves a request came from the Cloudflare network — not from your account specifically. If you need to guarantee requests come from your account, set up zone-level or per-hostname AOP with your own certificate.
Using your own certificate is also required for FIPS ↗ compliance. For broader origin protection guidance, refer to Protect your origin server.
Post-quantum certificates
Zone-level and per-hostname AOP support ML-DSA (FIPS 204) post-quantum client certificates. Refer to Post-quantum signatures for certificate generation and upload guidance.