{"id":4570,"date":"2026-09-19T02:01:53","date_gmt":"2026-09-18T20:31:53","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/cloudflare-origin-ca-authenticated-origin-pulls-aop-hardening-with-nginx-litespeed\/"},"modified":"2026-09-19T02:01:53","modified_gmt":"2026-09-18T20:31:53","slug":"cloudflare-origin-ca-authenticated-origin-pulls-aop-hardening-with-nginx-litespeed","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/cloudflare-origin-ca-authenticated-origin-pulls-aop-hardening-with-nginx-litespeed\/","title":{"rendered":"Cloudflare Origin CA & Authenticated Origin Pulls (AOP) Hardening with Nginx & LiteSpeed"},"content":{"rendered":"

Exposing an origin server’s public IP address completely undermines edge Web Application Firewalls (WAF), rate limiting rules, and distributed denial-of-service (DDoS) mitigation layers by allowing threat actors to bypass the proxy and attack backend compute resources directly. In modern multi-tenant cloud and web hosting environments powered by CpanelFree<\/a>, establishing strict cryptographic verification between Cloudflare edge nodes and upstream daemons is the single most effective barrier against origin disclosure, network snooping, and host-header spoofing. By deploying long-term Cloudflare Origin CA certificates alongside Authenticated Origin Pulls (AOP) via mutual TLS (mTLS), systems engineers can guarantee that only legitimate requests proxied through Cloudflare reach their Nginx and LiteSpeed backends.<\/p>\n

<\/p>\n

What is Cloudflare Authenticated Origin Pulls (AOP) and Origin CA Hardening?<\/h2>\n
\nDirect Answer:<\/strong> Cloudflare Authenticated Origin Pulls (AOP) enforces mutual TLS (mTLS) cryptographic authentication between Cloudflare edge proxies and your web origin. By validating Cloudflare’s client certificate against a pinned CA bundle while serving an encrypted Cloudflare Origin CA certificate, Nginx and LiteSpeed daemons reject any non-proxied connection attempting direct IP bypass, eliminating DDoS exposure and host-header spoofing.\n<\/div>\n

When organizations deploy a Reverse Proxy \/ Content Delivery Network (CDN) such as Cloudflare, the typical expectation is that all incoming public traffic traverses the edge network before arriving at the origin. However, routing DNS records through Cloudflare does not inherently protect the origin web server if its TCP ports (typically 80 and 443) remain reachable over the public IPv4\/IPv6 internet. If an attacker discovers the real host IP, they can craft direct HTTP\/HTTPS requests that circumvent edge WAF inspection, Bot Management heuristics, and caching infrastructure.<\/p>\n

The Anatomy of an Origin Direct-to-IP Bypass Attack<\/h2>\n

Origin IP disclosure is one of the most pervasive failure modes in edge security architecture. Automated reconnaissance scanners continuously index the entire IPv4 address space, probing every responsive IP for SSL\/TLS certificates and virtual host configurations. Threat actors leverage several vectors to map proxied domains to upstream origin servers:<\/p>\n

    \n
  • Historical DNS Records:<\/strong> Historical DNS databases (e.g., SecurityTrails, ViewDNS) retain past A and AAAA records prior to Cloudflare proxy activation. If an administrator migrated an existing domain without renumbering server IP addresses, the origin IP is permanently indexed in historical archives.<\/li>\n
  • SSL\/TLS Certificate Transparency (CT) Logs:<\/strong> Public automated certificates like Let’s Encrypt or ZeroSSL require ACME challenges and submit certificates to public CT logs. When a public certificate is generated directly on the origin, scanning bots query CT logs to associate the domain name with raw IP addresses listening on port 443.<\/li>\n
  • Outbound Network Traces & Mail Headers:<\/strong> Origin servers sending transactional emails (SMTP) or issuing outbound webhooks often leak their WAN IP in Received:<\/code> email headers or webhook socket metadata unless outbound NAT routing or external relay pools are configured.<\/li>\n
  • Direct SNI Scanning:<\/strong> Threat actors issue TLS ClientHello handshakes containing specific Server Name Indication (SNI) hostnames across entire ASN IP blocks. Unhardened servers return the domain’s certificate, confirming the physical host identity immediately.<\/li>\n<\/ul>\n
    \nArchitecture Note:<\/strong> Firewall allowlists (restricting ports 80\/443 strictly to Cloudflare’s published IP ranges) provide Layer 3\/4 filtering, but they do NOT authenticate the origin request at Layer 7. Any Cloudflare customer could configure a custom DNS record pointing to your origin IP and route their own malicious requests through Cloudflare’s network to bypass your firewall. Authenticated Origin Pulls (AOP) solves this at Layer 7 through cryptographic mutual authentication.<\/div>\n

    Architectural Comparative Matrix: Standard vs. Hardened Origin<\/h2>\n

    The following matrix outlines the fundamental architectural differences between a standard origin deployment and an enterprise-hardened origin utilizing Cloudflare Origin CA and Authenticated Origin Pulls:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
    Feature \/ Security Metric<\/th>\nStandard \/ Default Setup<\/th>\nTuned \/ Hardened Production<\/th>\n<\/tr>\n<\/thead>\n
    Origin Direct-IP Exposure<\/td>\nVulnerable (Direct 443 requests succeed)<\/td>\nCryptographically Blocked (mTLS Required)<\/td>\n<\/tr>\n
    Authentication Mechanism<\/td>\nOne-way TLS (Server certificate only)<\/td>\nTwo-way Mutual TLS (Server + Client AOP)<\/td>\n<\/tr>\n
    Certificate Maintenance Overhead<\/td>\n90-day Let’s Encrypt renewal cycles prone to ACME edge breakages<\/td>\nUp to 15-year Cloudflare Origin CA (Zero ACME failures)<\/td>\n<\/tr>\n
    Certificate Transparency Leakage<\/td>\nPublished to public CT logs, exposing backend subdomains<\/td>\nPrivate Origin CA (Zero CT log publication)<\/td>\n<\/tr>\n
    WAF \/ Edge Protection Enforcement<\/td>\nEasily bypassed via direct IP HTTP requests<\/td>\n100% Ingress forced through Cloudflare WAF & Rules<\/td>\n<\/tr>\n
    TLS Protocol & Handshake Speed<\/td>\nLegacy RSA 2048-bit with mixed TLS 1.2<\/td>\nPure TLS 1.3 + ECDSA P-256 (Sub-1ms Handshake)<\/td>\n<\/tr>\n
    Default VHost Handling<\/td>\nResponds with web server default page or first vhost<\/td>\nNon-standard close (HTTP 444) drops connection silently<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    Cloudflare Origin CA: Principles and Advantages<\/h2>\n

    Cloudflare Origin CA is a dedicated Certificate Authority managed by Cloudflare that issues free, trusted TLS certificates for deployment exclusively between Cloudflare edge nodes and upstream origin servers. Unlike browser-facing certificates, Origin CA certificates are trusted strictly by Cloudflare’s internal proxy infrastructure. This architecture offers several technical advantages for systems administrators:<\/p>\n

      \n
    1. Immunity to Certificate Transparency Reconnaissance:<\/strong> Because Origin CA certificates are intended solely for server-to-proxy transit, Cloudflare does not submit them to public Certificate Transparency logs. This eliminates a primary attack surface utilized by automated reconnaissance tools like Censys and Shodan.<\/li>\n
    2. Long-Term Validity Cycles (Up to 15 Years):<\/strong> Public CAs enforce a maximum certificate validity of 398 days, and ACME tools default to 90 days. When an origin is proxied behind Cloudflare, automated HTTP-01 ACME renewal challenges frequently fail due to edge cache routing or WAF challenge redirects. Cloudflare Origin CA certificates can be generated with a validity of up to 15 years, completely eradicating production outages caused by expired origin certificates.<\/li>\n
    3. Wildcard and Multi-SAN Support:<\/strong> A single Origin CA certificate can cover both root domains and deep wildcards (e.g., *.example.com<\/code>, example.com<\/code>, *.internal.example.com<\/code>), simplifying multi-tenant vhost provisioning in control panel environments.<\/li>\n
    4. High-Performance Elliptic Curve Cryptography:<\/strong> When generating Origin CA certificates, selecting the ECDSA (Curve P-256) algorithm yields 256-bit keys that provide security equivalent to 3072-bit RSA keys, dramatically reducing CPU computational overhead and memory consumption during TLS handshakes.<\/li>\n<\/ol>\n
      \nSecurity Hardening Rule:<\/strong> Never configure your Cloudflare SSL\/TLS encryption mode to “Flexible”. Flexible mode transmits traffic between Cloudflare and your origin in unencrypted cleartext HTTP, exposing sensitive credentials and session cookies to intermediate transit networks. Always enforce Full (strict)<\/strong> mode when pairing Cloudflare Origin CA with Authenticated Origin Pulls.<\/div>\n

      Authenticated Origin Pulls (AOP): Mechanics of Mutual TLS (mTLS)<\/h2>\n

      Standard TLS is one-way: the client verifies the identity of the server by inspecting the server’s X.509 certificate. The server has no cryptographic guarantee regarding the identity of the client. Authenticated Origin Pulls (AOP) flips this dynamic by establishing a bidirectional Mutual TLS (mTLS)<\/strong> handshake.<\/p>\n

      During an AOP-enabled connection, the cryptographic exchange proceeds through the following phases:<\/p>\n

        \n
      1. TCP Connection & ClientHello:<\/strong> A user requests content from your site. If the asset is a cache miss, Cloudflare’s edge proxy initiates a TCP connection to your origin IP on port 443 and transmits a TLS ClientHello<\/code>.<\/li>\n
      2. ServerHello & CertificateRequest:<\/strong> The origin server (Nginx or LiteSpeed) responds with its ServerHello<\/code>, presents its Cloudflare Origin CA certificate, and issues a CertificateRequest<\/code> frame demanding that the client present an X.509 client certificate issued by a specific trusted Certificate Authority.<\/li>\n
      3. Client Certificate Presentation:<\/strong> Cloudflare edge nodes retrieve the pinned Cloudflare Client Certificate and transmit it to the origin alongside a CertificateVerify<\/code> message signed by the client’s private key.<\/li>\n
      4. Origin Cryptographic Validation:<\/strong> The origin web server evaluates the presented client certificate against its local trusted CA bundle (Cloudflare’s AOP CA certificate). If the client certificate is missing, expired, or signed by an untrusted authority, the TLS handshake terminates immediately, and the connection is dropped.<\/li>\n<\/ol>\n

        Cloudflare supports two operational models for Authenticated Origin Pulls:<\/p>\n

          \n
        • Zone-Level AOP (Global Certificate):<\/strong> Uses Cloudflare’s shared origin-pull certificate. Any request routed through Cloudflare’s infrastructure presents this certificate. While effective at blocking direct internet scanners, it does not distinguish between different Cloudflare accounts.<\/li>\n
        • Per-Hostname AOP (Custom Client Certificates):<\/strong> Uploads a dedicated, tenant-specific client certificate to Cloudflare via the Cloudflare API. The origin verifies this unique client certificate, ensuring that only your specific Cloudflare zone can establish connections to your backend.<\/li>\n<\/ul>\n

          Linux Kernel & Network Stack Optimization for Edge Ingress<\/h2>\n

          Before implementing web server configurations, the underlying Linux kernel network stack must be tuned to process high-throughput TLS handshakes and handle rapid connection turnover from Cloudflare edge nodes without socket starvation.<\/p>\n

          Save the following configuration to \/etc\/sysctl.d\/99-cloudflare-origin-hardening.conf<\/code> to optimize TCP window scaling, SYN backlog queues, and connection reuse:<\/p>\n

          # \/etc\/sysctl.d\/99-cloudflare-origin-hardening.conf\n# Enterprise Network Stack Optimization for Cloudflare Origin Gateways\n\n# Enable TCP SYN Cookies for SYN flood mitigation\nnet.ipv4.tcp_syncookies = 1\n\n# Increase max backlog for incomplete connections (SYN received)\nnet.ipv4.tcp_max_syn_backlog = 8192\n\n# Max socket listen queue backlog for fully established connections\nnet.core.somaxconn = 65535\n\n# Reuse TIME_WAIT sockets for outgoing connections when safe\nnet.ipv4.tcp_tw_reuse = 1\n\n# Decrease TCP FIN timeout to reclaim disconnected sockets faster\nnet.ipv4.tcp_fin_timeout = 15\n\n# Increase network device backlog queue to prevent packet drops under burst\nnet.core.netdev_max_backlog = 16384\n\n# TCP Window Buffer Tuning (min, default, max) in bytes\nnet.ipv4.tcp_rmem = 4096 87380 16777216\nnet.ipv4.tcp_wmem = 4096 65536 16777216\n\n# Enable TCP BBR Congestion Control for low latency and high throughput\nnet.core.default_qdisc = fq\nnet.ipv4.tcp_congestion_control = bbr\n\n# Maximize local port range for high proxy concurrency\nnet.ipv4.ip_local_port_range = 10240 65535\n\n# Protect against TCP time-wait assassination hazards\nnet.ipv4.tcp_rfc1337 = 1<\/code><\/pre>\n
          Apply the sysctl configuration immediately without rebooting:<\/p>\n
          sudo sysctl --system<\/code><\/pre>\n
          Step-by-Step Implementation: Hardening Nginx with Origin CA & AOP<\/h2>\n
          Implementing Cloudflare Authenticated Origin Pulls Nginx requires three operational artifacts:<\/p>\n
            \n
          1. The Cloudflare Origin CA Certificate and Private Key (e.g., origin-cert.pem<\/code> and origin-key.key<\/code>).<\/li>\n
          2. The Cloudflare Authenticated Origin Pull CA Certificate (cloudflare-aop.pem<\/code>).<\/li>\n
          3. An enterprise-grade Nginx server configuration enforcing client certificate verification, Cloudflare Real-IP restoration, and non-standard connection closure for unauthorized probes.<\/li>\n<\/ol>\n
            1. Download the Cloudflare AOP CA Bundle<\/h3>\n
            Fetch the official Cloudflare Authenticated Origin Pull certificate authority bundle and set secure filesystem permissions:<\/p>\n
            sudo mkdir -p \/etc\/nginx\/ssl\nsudo curl -sS -o \/etc\/nginx\/ssl\/cloudflare-aop.pem https:\/\/developers.cloudflare.com\/ssl\/static\/authenticated_origin_pull_ca.pem\nsudo chmod 644 \/etc\/nginx\/ssl\/cloudflare-aop.pem\nsudo chmod 600 \/etc\/nginx\/ssl\/origin-key.key<\/code><\/pre>\n
            2. Deploy the Production Nginx Virtual Host Configuration<\/h3>\n
            Place the following production-hardened configuration inside \/etc\/nginx\/conf.d\/origin-hardened.conf<\/code>. This configuration includes a default catch-all server block that silently drops unauthorized scanners using HTTP status code 444, restores real client visitor IPs from Cloudflare headers, and validates client certificates on port 443:<\/p>\n
            # \/etc\/nginx\/conf.d\/origin-hardened.conf\n\n# ------------------------------------------------------------------------------\n# 1. Default Catch-All Server Block: Drop Unauthorized Direct IP Scans\n# ------------------------------------------------------------------------------\nserver {\n    listen 80 default_server;\n    listen [::]:80 default_server;\n    listen 443 ssl default_server;\n    listen [::]:443 ssl default_server;\n    server_name _;\n\n    # Use dummy self-signed or fallback certificate for default handshake\n    ssl_certificate \/etc\/nginx\/ssl\/origin-cert.pem;\n    ssl_certificate_key \/etc\/nginx\/ssl\/origin-key.key;\n\n    # Immediately close connection without transmitting response headers\n    return 444;\n}\n\n# ------------------------------------------------------------------------------\n# 2. Upstream Real-IP Restoration from Cloudflare Edge Proxies\n# ------------------------------------------------------------------------------\n# Cloudflare IPv4 Subnets\nset_real_ip_from 173.245.48.0\/20;\nset_real_ip_from 103.21.244.0\/22;\nset_real_ip_from 103.22.200.0\/22;\nset_real_ip_from 103.31.4.0\/22;\nset_real_ip_from 141.101.64.0\/18;\nset_real_ip_from 108.162.192.0\/18;\nset_real_ip_from 190.93.240.0\/20;\nset_real_ip_from 188.114.96.0\/20;\nset_real_ip_from 197.234.240.0\/22;\nset_real_ip_from 198.41.128.0\/17;\nset_real_ip_from 162.158.0.0\/15;\nset_real_ip_from 104.16.0.0\/13;\nset_real_ip_from 104.24.0.0\/14;\nset_real_ip_from 172.64.0.0\/13;\nset_real_ip_from 131.0.72.0\/22;\n\n# Cloudflare IPv6 Subnets\nset_real_ip_from 2400:cb00::\/32;\nset_real_ip_from 2606:4700::\/32;\nset_real_ip_from 2803:f800::\/32;\nset_real_ip_from 2405:b500::\/32;\nset_real_ip_from 2405:8100::\/32;\nset_real_ip_from 2a06:98c0::\/29;\nset_real_ip_from 2c0f:f248::\/32;\n\nreal_ip_header CF-Connecting-IP;\nreal_ip_recursive on;\n\n# ------------------------------------------------------------------------------\n# 3. Production Hardened Domain Virtual Host with Authenticated Origin Pulls\n# ------------------------------------------------------------------------------\nserver {\n    listen 443 ssl http2;\n    listen [::]:443 ssl http2;\n    server_name example.com www.example.com;\n\n    # Cloudflare Origin CA Certificate & Private Key\n    ssl_certificate \/etc\/nginx\/ssl\/origin-cert.pem;\n    ssl_certificate_key \/etc\/nginx\/ssl\/origin-key.key;\n\n    # Authenticated Origin Pulls (mTLS) Client Verification\n    ssl_client_certificate \/etc\/nginx\/ssl\/cloudflare-aop.pem;\n    ssl_verify_client on;\n    ssl_verify_depth 2;\n\n    # Enforce Modern Cryptographic Standards (TLS 1.3 preferred)\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';\n    ssl_prefer_server_ciphers on;\n    ssl_session_cache shared:SSL:50m;\n    ssl_session_timeout 1d;\n    ssl_session_tickets off;\n\n    # Terminate connection if client verification fails\n    error_page 495 496 497 =444 \/dev\/null;\n\n    # Security Response Headers\n    add_header X-Frame-Options \"SAMEORIGIN\" always;\n    add_header X-Content-Type-Options \"nosniff\" always;\n    add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;\n\n    root \/var\/www\/html\/example;\n    index index.php index.html;\n\n    location \/ {\n        try_files $uri $uri\/ \/index.php?$args;\n    }\n\n    location ~ \\.php$ {\n        include fastcgi_params;\n        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;\n        fastcgi_pass unix:\/run\/php\/php8.3-fpm.sock;\n    }\n}<\/code><\/pre>\n
            Verify Nginx syntax and reload the service:<\/p>\n
            sudo nginx -t && sudo systemctl reload nginx<\/code><\/pre>\n
            \nOperational Tip:<\/strong> Before enabling ssl_verify_client on;<\/code> in your production Nginx block, ensure that Authenticated Origin Pulls<\/strong> is toggled to ON<\/strong> in the Cloudflare Dashboard under SSL\/TLS > Origin Server<\/em>. If you activate origin client verification before Cloudflare edge nodes begin sending the client certificate, all proxy requests will fail with HTTP 525 (SSL Handshake Failed) or HTTP 520 errors.<\/div>\n
            Step-by-Step Implementation: Hardening LiteSpeed & OpenLiteSpeed<\/h2>\n
            LiteSpeed Web Server (LSWS) and OpenLiteSpeed (OLS) deliver class-leading PHP performance, built-in LSCache acceleration, and low event-loop overhead. Hardening LiteSpeed with Cloudflare Origin CA and Authenticated Origin Pulls ensures maximum concurrency while maintaining rigid mTLS boundaries.<\/p>\n
            LiteSpeed Virtual Host Configuration (vhconf.conf)<\/h3>\n
            Add the following directives to your LiteSpeed virtual host configuration file located at \/usr\/local\/lsws\/conf\/vhosts\/example\/vhconf.conf<\/code> or configure them via the LiteSpeed WebAdmin Console under Virtual Hosts > SSL<\/em>:<\/p>\n
            # \/usr\/local\/lsws\/conf\/vhosts\/example\/vhconf.conf\n\n# SSL Context and Key Pair\nssl  {\n  keyFile                 \/usr\/local\/lsws\/conf\/ssl\/origin-key.key\n  certFile                \/usr\/local\/lsws\/conf\/ssl\/origin-cert.pem\n  certChain               1\n  sslProtocol             30\n  ciphers                 ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384\n  enableECDHE             1\n  renegotiationProtection 1\n  sslSessionCache         1\n  sslSessionTickets       0\n  \n  # Authenticated Origin Pulls Client Verification Directives\n  clientVerify            1\n  verifyDepth             2\n  caCertFile              \/usr\/local\/lsws\/conf\/ssl\/cloudflare-aop.pem\n}<\/code><\/pre>\n
            Restoring Visitor Real IPs in LiteSpeed Server Configuration<\/h3>\n
            In \/usr\/local\/lsws\/conf\/httpd_config.conf<\/code>, instruct LiteSpeed to trust incoming headers from Cloudflare reverse proxies:<\/p>\n
            # Enable Real IP extraction from Reverse Proxies\nuseIpInProxyHeader        1\n\n# Configure Cloudflare IP blocks under allowed proxy list\nipFilter  {\n  allow                   173.245.48.0\/20, 103.21.244.0\/22, 103.22.200.0\/22, 103.31.4.0\/22, 141.101.64.0\/18, 108.162.192.0\/18, 190.93.240.0\/20, 188.114.96.0\/20, 197.234.240.0\/22, 198.41.128.0\/17, 162.158.0.0\/15, 104.16.0.0\/13, 104.24.0.0\/14, 172.64.0.0\/13, 131.0.72.0\/22, 2400:cb00::\/32, 2606:4700::\/32, 2803:f800::\/32, 2405:b500::\/32, 2405:8100::\/32, 2a06:98c0::\/29, 2c0f:f248::\/32\n}<\/code><\/pre>\n
            Perform a graceful restart of LiteSpeed to apply the updated SSL and client verification configuration:<\/p>\n
            sudo \/usr\/local\/lsws\/bin\/lswsctrl graceful<\/code><\/pre>\n
            Layer 3\/4 Defense-in-Depth: Automated IP Tables Cloudflare Sync<\/h2>\n
            While Layer 7 mTLS verification completely prevents unauthorized HTTP processing, malicious actors sending millions of TCP handshakes directly to port 443 can still consume server CPU cycles through TLS handshake computations. Implementing an automated Layer 3\/4 firewall rule using ipset<\/code> and iptables<\/code> ensures packets from non-Cloudflare IPs are discarded immediately at the kernel network boundary.<\/p>\n
            Create the automated synchronization script at \/usr\/local\/sbin\/sync-cloudflare-firewall.sh<\/code>:<\/p>\n
            #!\/usr\/bin\/env bash\n# \/usr\/local\/sbin\/sync-cloudflare-firewall.sh\n# Dynamically synchronizes Cloudflare edge IPs into Linux ipset and iptables\n\nset -euo pipefail\n\nIPSET_NAME=\"cloudflare_ips\"\nTEMP_IPSET_NAME=\"cloudflare_ips_temp\"\n\n# Create new temporary ipset\nipset create \"${TEMP_IPSET_NAME}\" hash:net family inet -exist\n\n# Download and populate current Cloudflare IPv4 ranges\necho \"Fetching latest Cloudflare IPv4 prefixes...\"\ncurl -sS https:\/\/www.cloudflare.com\/ips-v4 | while read -r cidr; do\n    if [[ -n \"${cidr}\" ]]; then\n        ipset add \"${TEMP_IPSET_NAME}\" \"${cidr}\"\n    fi\ndone\n\n# Swap temporary set with live set atomically\nipset create \"${IPSET_NAME}\" hash:net family inet -exist\nipset swap \"${TEMP_IPSET_NAME}\" \"${IPSET_NAME}\"\nipset destroy \"${TEMP_IPSET_NAME}\"\n\n# Ensure iptables rules exist to enforce traffic strictly from ipset on ports 80 & 443\nif ! iptables -C INPUT -p tcp -m multiport --dports 80,443 -m set ! --match-set \"${IPSET_NAME}\" src -j DROP 2>\/dev\/null; then\n    echo \"Adding iptables enforcement rule for Cloudflare IP set...\"\n    iptables -I INPUT -p tcp -m multiport --dports 80,443 -m set ! --match-set \"${IPSET_NAME}\" src -j DROP\nfi\n\necho \"Cloudflare firewall synchronization completed successfully.\"<\/code><\/pre>\n
            Grant execution permissions and automate via a daily systemd timer or cron job:<\/p>\n
            sudo chmod +x \/usr\/local\/sbin\/sync-cloudflare-firewall.sh\nsudo \/usr\/local\/sbin\/sync-cloudflare-firewall.sh<\/code><\/pre>\n
            Verification, Diagnostic Probing, and Benchmark Testing<\/h2>\n
            After completing Nginx or LiteSpeed configuration and enabling Authenticated Origin Pulls in the Cloudflare dashboard, verify that unauthorized requests are blocked and valid requests are served correctly.<\/p>\n
            1. Test Direct Origin Connection Without Client Certificate<\/h3>\n
            Run curl<\/code> directly against your origin server’s public IP address, bypassing Cloudflare’s edge proxy:<\/p>\n
            curl -Iv -k --resolve example.com:443:YOUR_ORIGIN_IP https:\/\/example.com<\/code><\/pre>\n
            Expected result: Nginx or LiteSpeed terminates the TLS handshake during client certificate negotiation, producing:<\/p>\n
            * OpenSSL SSL_connect: Connection reset by peer in connection to example.com:443\n* Closing connection 0\ncurl: (35) OpenSSL SSL_connect: Connection reset by peer in connection to example.com:443<\/code><\/pre>\n
            2. Simulate Cloudflare Edge Handshake with Official Client Certificate<\/h3>\n
            Verify that providing the trusted Cloudflare client certificate completes the mTLS handshake successfully:<\/p>\n
            openssl s_client -connect YOUR_ORIGIN_IP:443 \\\n  -servername example.com \\\n  -cert \/etc\/nginx\/ssl\/cloudflare-aop.pem<\/code><\/pre>\n
            Expected output: The verification handshake verifies successfully (Verify return code: 0 (ok)<\/code>), confirming that edge proxies presenting the authentic Cloudflare certificate are authorized to pull origin data.<\/p>\n
            Frequently Asked Questions<\/h2>\n
            \nCan I use Let’s Encrypt certificates on my origin alongside Authenticated Origin Pulls?<\/summary>\n
            While technically possible, using Let’s Encrypt on the origin is discouraged. Let’s Encrypt certificates require renewals every 90 days, which often fail when proxied through Cloudflare due to HTTP-01 ACME challenge interception. Furthermore, Let’s Encrypt certificates are permanently published to public Certificate Transparency logs, which automated scrapers monitor to discover origin IP addresses. Using a 15-year Cloudflare Origin CA certificate provides zero-maintenance, private, and strictly verified encryption.<\/p>\n<\/details>\n
            \nWhat is the difference between Zone-Level AOP and Per-Hostname AOP?<\/summary>\n
            Zone-Level AOP utilizes Cloudflare’s shared global client certificate. Any Cloudflare customer could theoretically point a proxy to your origin IP and pass the mTLS check. Per-Hostname AOP utilizes custom client certificates uploaded directly to your specific zone via the Cloudflare API. Your origin validates the unique cryptographic fingerprint or custom CA of your specific account, ensuring no other Cloudflare tenant can route traffic to your upstream server.<\/p>\n<\/details>\n
            \nWhy does Nginx return HTTP status code 444 instead of 403 Forbidden?<\/summary>\n
            HTTP 444 is a non-standard Nginx directive that instructs the server to close the connection immediately without sending any response headers or body back to the client. This denies scanning tools and malicious probes any fingerprinting data, software banner strings, or latency confirmation, significantly complicating automated reconnaissance.<\/p>\n<\/details>\n
            \nDoes Authenticated Origin Pulls introduce measurable latency to visitor page loads?<\/summary>\n
            No. Authenticated Origin Pulls operates solely between Cloudflare edge data centers and your origin server on cache misses. Cloudflare maintains persistent, warm TCP\/TLS connection pools to origins. When combined with TLS 1.3 session resumption and the Linux kernel sysctl optimizations documented in this guide, origin mTLS validation introduces under 1 millisecond of computational overhead.<\/p>\n<\/details>\n
            \n
            Ready to Deploy High-Performance Infrastructure?<\/h3>\n
            Experience blazing-fast NVMe storage, unmetered bandwidth, and enterprise LiteSpeed caching on CpanelFree.<\/p>\n
              Get Started with Free Cloud Hosting →<\/a>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
            Block direct-to-IP bypass attacks on your origin server. Configure Cloudflare Origin CA and Authenticated Origin Pulls on Nginx and LiteSpeed.<\/p>\n","protected":false},"author":1,"featured_media":4569,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[172],"tags":[57,177,87,173,101],"class_list":["post-4570","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-hardening","tag-almalinux","tag-databases-performance","tag-devops","tag-security-hardening","tag-sysadmin"],"_links":{"self":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4570","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/comments?post=4570"}],"version-history":[{"count":0,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/posts\/4570\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/media\/4569"}],"wp:attachment":[{"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/media?parent=4570"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/categories?post=4570"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpanelfree.com\/blog\/wp-json\/wp\/v2\/tags?post=4570"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}