Origin certificate

As explained in Building Web APIs with ASP.NET Core

An origin certificate is a digital certificate presented by an origin server to authenticate it and enable encrypted communication with a connecting service.

An origin certificate authenticates the server hosting an application and lets Cloudflare connect to it over HTTPS. Cloudflare serves a separate edge certificate to visitors; the origin certificate protects the connection between Cloudflare and the origin host. section 12.2.4 section 12.1.3

Figure 12.1 Edge-origin architectural pattern

The edge-origin pattern shows where the certificate is used: between the CDN edge and the origin server. section 12.1.3

Create and install an origin certificate through this deployment sequence:

• Open Cloudflare’s SSL/TLS Origin Server settings and create a certificate with Cloudflare-generated RSA 2048 private key and CSR, default hostnames, and a 15-year lifetime. section 12.2.4
• Save the generated certificate and private key in a secure local folder; these files are needed when configuring the origin host. section 12.2.4
• Convert the PEM certificate and KEY file to a PFX (PKCS#12) file with OpenSSL, because IIS cannot directly import the original format. section 12.3.5
• Protect the generated PFX with an export password, then import it through IIS Manager; delete the original PEM and KEY files after conversion when they are no longer needed. section 12.3.5

Convert the certificate for IIS

From the folder containing the certificate files, run OpenSSL’s PKCS#12 export command: "C:\Program Files\OpenSSL-Win64\bin\openssl.exe" pkcs12 -export -out mybglist_origin.pfx -in mybglist_origin.pem -inkey mybglist_origin.key. Enter and confirm an export password to generate the PFX file. section 12.3.5

How Building Web APIs with ASP.NET Core covers it

How deep it goes

Explains creation, secure storage, format conversion, and IIS import, but does not detail later IIS binding configuration.

Examples

Uses Cloudflare’s certificate form, an OpenSSL PKCS#12 command, and IIS Manager’s certificate-import workflow.

What it assumes

Assumes a Cloudflare-managed domain and Windows IIS host, while introducing certificate creation and PEM-to-PFX conversion.

What you can do after

Operate/configure an HTTPS connection from Cloudflare to an IIS-hosted origin using a converted PFX certificate.

How it connects

Connects CDN edge certificates with Cloudflare, SSL/TLS encryption, OpenSSL, PFX files, and IIS.

liveBookmanning.com

Read Building Web APIs with ASP.NET Core on liveBook Get the book at manning.com

Related concepts

• Cloudflareused by · Cloudflare is a global network and cloud services platform providing content delivery, DNS, traffic management, and internet security services.
• certificatekind of · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• HTTPSconfigures · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.
• Internet Information Servicesused by · Internet Information Services is Microsoft's web server and application-hosting platform for Windows.

This explainer was generated by Manning's knowledge graph from the text of Building Web APIs with ASP.NET Core. The section links point to the parts of the book it draws on.