Enable origin SSL validation

Origin SSL validation makes CDN edge servers verify that the origin presents a valid TLS certificate for the expected hostname. proxy_ssl_ca is the public CA certificate that checks the origin certificate, while proxy_ssl_data is an uploaded certificate and private key that the edge presents when the origin requests a client certificate.

An API token is required, along with a CDN resource configured for HTTPS origin pull, a CA certificate to store as proxy_ssl_ca, and an uploaded SSL certificate to send as proxy_ssl_data.

export GCORE_API_KEY="{YOUR_API_KEY}"

Add a trusted CA certificate

Upload the CA certificate that issued the origin certificate. If the origin certificate is self-signed, upload that certificate itself. A trusted CA request stores that public certificate and returns the id for proxy_ssl_ca.

Python SDK
Go SDK
curl

from gcore import Gcore

client = Gcore()  # Reads GCORE_API_KEY from env

ca = client.cdn.trusted_ca_certificates.create(
    name="origin.mywebsite.com",
    ssl_certificate=open("ca.pem", encoding="ascii").read(),
)
print(ca.id)

package main

import (
    "context"
    "fmt"
    "os"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient() // Reads GCORE_API_KEY from env
    ctx := context.Background()

    pem, err := os.ReadFile("ca.pem")
    if err != nil {
        panic(err)
    }
    ca, err := client.CDN.TrustedCaCertificates.New(ctx, cdn.TrustedCaCertificateNewParams{
        Name:           "origin.mywebsite.com",
        SslCertificate: string(pem),
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(ca.ID)
}

curl -X POST "https://api.gcore.com/cdn/sslCertificates" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "origin.mywebsite.com",
    "sslCertificate": "-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----\n"
  }'

The API returns:

{
  "id": 1004,
  "name": "origin.mywebsite.com"
}

Get the SSL certificate ID

Use the id of the uploaded client certificate and private key as proxy_ssl_data. This object is separate from the trusted CA. A certificate list returns the id of the certificate with that name.

Python SDK
Go SDK
curl

from gcore import Gcore

client = Gcore()

certificates = client.cdn.certificates.list()
cert_id = next(item.id for item in certificates if item.name == "client.mywebsite.com")
print(cert_id)

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    page, err := client.CDN.Certificates.List(ctx, cdn.CertificateListParams{})
    if err != nil {
        panic(err)
    }
    var certID int64
    for _, item := range page.Results {
        if item.Name == "client.mywebsite.com" {
            certID = item.ID
            break
        }
    }
    fmt.Println(certID)
}

curl "https://api.gcore.com/cdn/sslData?limit=1000" \
  -H "Authorization: APIKey $GCORE_API_KEY"

The API returns:

{
  "results": [
    {
      "id": 1003,
      "name": "client.mywebsite.com"
    }
  ]
}

Enable validation on the resource

The first resource update requires both certificate ids even when the origin does not request a client certificate. Omitting either id returns HTTP 400 with the message Can not enable proxy_ssl feature while both proxy CA certificate and proxy ssl data not specified.

Python SDK
Go SDK
curl

from gcore import Gcore

client = Gcore()

resource = client.cdn.cdn_resources.update(
    1001,
    proxy_ssl_enabled=True,
    proxy_ssl_ca=1004,
    proxy_ssl_data=1003,
)
print(resource.proxy_ssl_enabled, resource.proxy_ssl_ca, resource.proxy_ssl_data)

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    resource, err := client.CDN.CDNResources.Update(ctx, 1001, cdn.CDNResourceUpdateParams{
        ProxySslEnabled: gcore.Bool(true),
        ProxySslCa:      gcore.Int(1004),
        ProxySslData:    gcore.Int(1003),
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(resource.ProxySslEnabled, resource.ProxySslCa, resource.ProxySslData)
}

curl -X PATCH "https://api.gcore.com/cdn/resources/1001" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "proxy_ssl_enabled": true,
    "proxy_ssl_ca": 1004,
    "proxy_ssl_data": 1003
  }'

The API returns:

{
  "id": 1001,
  "proxy_ssl_enabled": true,
  "proxy_ssl_ca": 1004,
  "proxy_ssl_data": 1003
}

proxy_ssl_ca and proxy_ssl_data refer to different certificate collections. Sending an SSL certificate id as proxy_ssl_ca, or a trusted CA id as proxy_ssl_data, returns HTTP 400 with the message Invalid pk "1003" - object does not exist.

Disable validation on the resource

The same update turns validation off when proxy_ssl_enabled is false and keeps both certificate ids. A later update can set proxy_ssl_enabled to true alone, because those ids are already stored.

Python SDK
Go SDK
curl

from gcore import Gcore

client = Gcore()

resource = client.cdn.cdn_resources.update(1001, proxy_ssl_enabled=False)
print(resource.proxy_ssl_enabled, resource.proxy_ssl_ca, resource.proxy_ssl_data)

package main

import (
    "context"
    "fmt"

    gcore "github.com/G-Core/gcore-go"
    "github.com/G-Core/gcore-go/cdn"
)

func main() {
    client := gcore.NewClient()
    ctx := context.Background()

    resource, err := client.CDN.CDNResources.Update(ctx, 1001, cdn.CDNResourceUpdateParams{
        ProxySslEnabled: gcore.Bool(false),
    })
    if err != nil {
        panic(err)
    }
    fmt.Println(resource.ProxySslEnabled, resource.ProxySslCa, resource.ProxySslData)
}

curl -X PATCH "https://api.gcore.com/cdn/resources/1001" \
  -H "Authorization: APIKey $GCORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"proxy_ssl_enabled": false}'

The API returns:

{
  "id": 1001,
  "proxy_ssl_enabled": false,
  "proxy_ssl_ca": 1004,
  "proxy_ssl_data": 1003
}

Account settings

Developer Tools

CDN

FastEdge

Edge Cloud

AI

Gclaw

Managed DNS

Public DNS

Hosting

Colocation

Object Storage

Video Streaming

DDoS protection

Edge Proxy

WAAP

Add a trusted CA certificate

Get the SSL certificate ID

Enable validation on the resource

Disable validation on the resource

​Add a trusted CA certificate

​Get the SSL certificate ID

​Enable validation on the resource

​Disable validation on the resource

Add a trusted CA certificate

Get the SSL certificate ID

Enable validation on the resource

Disable validation on the resource