Per-hostname authenticated origin pulls
When you enable authenticated origin pulls per hostname, all proxied traffic to the specified hostname is authenticated at the origin web server. Customers can use client certificates from their Private PKI to authenticate connections from Cloudflare.
1. Upload custom certificate
First, upload a custom certificate following these instructions, but use the /origin_tls_client_auth/hostnames/certificates endpoint.
In the API response, save the certificate id since it is required for the next step.
2. Enable authenticated origin pulls (globally)
Then, enable authenticated origin pulls as an option for your Cloudflare zone.
To enable Authenticated Origin Pulls in the dashboard:
- Log in to your Cloudflare account and go to a specific domain.
- Navigate to SSL/TLS > Origin Server.
- For Authenticated Origin Pulls, switch the toggle to On.
To enable or disable Authenticated Origin Pulls with the API, send a
PATCH request with the value parameter set to your desired setting ("on" or "off"). 3. Enable authenticated origin pulls for the hostname
Finally, use the Cloudflare API to send a PUT request to enable authenticated origin pulls for specific hostnames.