> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable origin SSL validation

Origin SSL validation makes CDN edge servers verify the origin TLS certificate before completing an HTTPS pull. Without it, CDN-to-origin HTTPS traffic can still be exposed to a [man-in-the-middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attack because edge servers do not check that the origin certificate is valid and issued for the expected host.

Configure the [origin pull protocol](/cdn/cdn-resource-options/general/specify-an-origin-and-the-origin-pull-protocol) to HTTPS to secure all origin pulls with TLS. With HTTP and HTTPS, origin SSL validation applies only when the CDN uses HTTPS for the origin request.

<Info>
  Configure origin SSL validation through the [CDN API](/api-reference/cdn/ca-certificates/get-trusted-ca-certificates-list). An [API token](/account-settings/api-tokens) is required.
</Info>

## Compatible certificates

Upload the public CA certificate that issued the origin certificate. For a self-signed origin certificate, upload that certificate as the trusted certificate.

Gcore automated Let's Encrypt certificates used for client HTTPS delivery cannot be used for origin SSL validation. The client certificate referenced by `proxy_ssl_data` must be a manually uploaded SSL certificate.

The API requires `proxy_ssl_data` when origin SSL validation is enabled, but the origin determines whether client authentication is optional or mandatory. To require mutual TLS, configure the origin to request a client certificate, trust the CA that issued the uploaded client certificate, and reject connections that do not present a valid certificate.

## Connection flow

The certificate validation process works as follows.

1. On a cache miss, a CDN edge server connects to the origin over HTTPS.
2. The origin presents its X.509 certificate. The edge server validates the certificate chain using the trusted CA (`proxy_ssl_ca`) and presents the client certificate (`proxy_ssl_data`) when the origin requires it.
3. If validation succeeds, the edge server pulls the content and serves it to the client.

## API configuration

Use the CDN API to configure the required certificates and resource fields.

1. Create a trusted CA certificate with [Add CA certificate](/api-reference/cdn/ca-certificates/add-trusted-ca-certificate). Note the returned certificate ID.
2. Create a manually uploaded (non-automated) SSL certificate with [Add SSL certificate](/api-reference/cdn/ssl-certificates/add-ssl-certificate). Note the returned certificate ID.
3. Update the CDN resource with [Change CDN resource](/api-reference/cdn/cdn-resources/change-cdn-resource):

   * Set `originGroup` to the ID of the existing origin group attached to the CDN resource.
   * Set `proxy_ssl_ca` to the trusted CA certificate ID.
   * Set `proxy_ssl_data` to the client SSL certificate ID.
   * Set `proxy_ssl_enabled` to `true`.

   The minimal request body includes the existing origin-group ID and the three SSL validation fields:

   ```json theme={null}
   {
     "originGroup": 12345,
     "proxy_ssl_ca": 67890,
     "proxy_ssl_data": 67891,
     "proxy_ssl_enabled": true
   }
   ```

   Replace the numeric values with the existing origin-group ID and the certificate IDs returned in the previous steps.

Both `proxy_ssl_ca` and `proxy_ssl_data` are required when `proxy_ssl_enabled` is `true`, even when the origin does not require client authentication.