Introducing Image Stack
Get started for free Sign in

Select the Gcore Platform

Recommended
Gcore Edge Solutions
Go to Gcore Platform →
Products:
  • Edge Delivery (CDN)
  • DNS with failover
  • Virtual Machines
  • Bare Metal
  • Cloud Load Balancers
  • Managed Kubernetes
  • AI Infrastructure
  • Edge Security (DDOS+WAF)
  • FaaS
  • Streaming
  • Object Storage
  • ImageStack (Optimize and Resize)
  • Edge Compute (Coming soon)
Gcore Hosting
Go to Gcore Hosting →
Products:
  • VPS Hosting
  • Dedicated Servers
  • SSL Certificates

What is Origin SSL Certificate Verification

Published December 14, 2020



The Gcore CDN uses advanced technology to protect and secure content delivery.

To enhance security, we’ve built an origin server authentication mechanism into the content retrieval process.

Why do I need an origin SSL certificate?

When configuring the protocol for interaction with the origin, you specify the protocol by which the CDN servers will contact the origin for content. You can decide whether the connection should be encrypted (HTTPS) or not (HTTP).

What is Origin SSL Certificate Verification

If HTTPS is selected, cache servers will access and receive content from the origin over HTTPS. This process is encrypted but it doesn’t protect against man-in-the-middle attacks because, by default, the cache server doesn’t check whether the responding server belongs to the client when requesting content.

What is Origin SSL Certificate Verification
Man-in-the-middle attack scheme

To ensure the security of the transmitted data, use the “Validate origin using SSL” option.

This option also allows clients to check the validity of requests from our cache servers without using a list of IP addresses and constantly updating it.

How does it work?

You specify the PEM-encoded public part of the X.509 digital certificate in our system. The other part of the certificate is stored on your origin server. Each certificate in the system is assigned its own identifier, and this information is stored on each CDN server. You can request information about a certificate (or about all certificates available in the system) and change its name at any time.

What is Origin SSL Certificate Verification
Origin server validation scheme
  1. When a request comes from a user, the cache server contacts the origin server for access to protected information.
  2. In response, the origin server provides its X.509 certificate.
  3. The cache server checks the digital signature of the public key in the system.
  4. If successful, the cache server sends its certificate to the origin server.
  5. The origin server verifies the received certificate in the same way.
  6. If this check is also successful, the origin server provides access to protected information.
  7. The CDN fetches content from the origin server and caches it for transmission to the user.
  8. If certificate verification fails, the cache server automatically rejects the request and doesn’t send data to an unverified server.

How do I enable this feature?

For now, this feature can only be enabled via API.

Enable feature

Share this article

Related articles

Uncategorized
Privately Access Instagram and Telegram with a Gcore OpenVPN Instance
In our interconnected, digital world, privacy is paramount. To maintain your data privacy when using Instagram, Telegram, and other services,...
May 15, 2023 3 min read
Uncategorized
Install and Play Quake III Arena in Docker Using Gcore Basic
In this tutorial, we’ll explore how to install Quake III Arena, a popular first-person shooter, in Docker, and then play...
May 9, 2023 3 min read
Uncategorized
Install nginx on Kubernetes Using Gcore Managed Kubernetes and Helm
In this tutorial, we’ll explore how to install nginx in a Kubernetes cluster using the Gcore Managed Kubernetes service and...
May 4, 2023 4 min read

Subscribe to a useful newsletter

Favorable offers and important news once a month. No spam.