Skip to content

SYSTEM Cited by 1 source

Cloudflare Authenticated Origin Pulls

What

Authenticated Origin Pulls (AOP) is a Cloudflare product that configures Cloudflare to present a client certificate to the customer's origin server, establishing a mutual TLS (mTLS) connection. This allows the origin to verify that incoming requests genuinely come from Cloudflare's servers, limiting abuse and unauthorized resource consumption.

AOP is available for free on all Cloudflare plan levels.

Three configuration levels

  • Global — Cloudflare-managed certificate applied to all zones (not yet PQ-enabled as of July 2026).
  • Per-zone — Customer uploads their own client certificate and private key; applied to all hostnames in the zone. Now supports ML-DSA (all FIPS 204 parameter sets).
  • Per-hostname — Same as per-zone but scoped to specific hostnames. Now supports ML-DSA.

Post-quantum ML-DSA support (July 2026)

Per-zone and per-hostname AOP now accept ML-DSA certificates and private keys (in FIPS 204 seed-only encoding format). Cloudflare's TLS client (Pingora Origin via BoringSSL) presents this PQ certificate to authenticate itself when connecting to the origin.

Combined with COTS, customers can achieve fully post-quantum mutual TLS on the Cloudflare→origin connection.

(Source: sources/2026-07-29-cloudflare-post-quantum-authentication-to-origins)

Seen in

Last updated · 602 distilled / 1,824 read