{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/cloudflared-origin-tls-name-ca-troubleshooting/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/",
        "slug": "cloudflared-origin-tls-name-ca-troubleshooting",
        "url": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/cloudflared-origin-tls-name-ca-troubleshooting/"
        },
        "title": "Keep origin certificate validation while troubleshooting cloudflared",
        "summary": "Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-15T00:43:25+00:00",
        "modified_at": "2026-10-15T00:44:33+00:00",
        "reviewed_on": "2026-10-14",
        "reading_minutes": 2,
        "word_count": 238,
        "potentially_affected": "This article concerns the tunnel-to-origin HTTPS connection. Record the exact error and origin service before applying a remedy to another TLS connection in the request path.",
        "dse_recommendation": "DSE recommends collecting the origin address, configured expected name, certificate names, issuer chain, validity period, and tunnel configuration in a sanitized diagnostic record.",
        "primary_source": {
            "name": "Cloudflare — Tunnel troubleshooting",
            "url": "https://developers.cloudflare.com/tunnel/troubleshooting/",
            "published_on": null,
            "authority": "developers.cloudflare.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.</p>\n<h2>Source facts</h2>\n<p>Cloudflare’s troubleshooting guide describes different x509 failures between cloudflared and an HTTPS origin. A certificate valid for a different name calls for checking the expected server name, including originServerName. An unknown-authority error calls for reviewing trust, with caPool available for the relevant CA material. The guide also describes noTLSVerify as disabling certificate verification; that setting changes what cloudflared validates.</p>\n<p>Source: <a href=\"https://developers.cloudflare.com/tunnel/troubleshooting/\">Cloudflare — Tunnel troubleshooting</a>.</p>\n<h2>Applicability</h2>\n<p>This article concerns the tunnel-to-origin HTTPS connection. Record the exact error and origin service before applying a remedy to another TLS connection in the request path.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends collecting the origin address, configured expected name, certificate names, issuer chain, validity period, and tunnel configuration in a sanitized diagnostic record. Correct the mismatch or trust configuration through the approved certificate process. Verify the CA through a trusted administrative channel before installing it. Keep certificate validation enabled in the accepted configuration rather than closing the issue after a bypass makes the page load. Preserve the previous configuration and a rollback path for the change window.</p>\n<h2>Verification</h2>\n<p>Repeat the application transaction with validation enabled, then confirm that the original x509 error is resolved. Where safely testable, verify rejection of an intentionally mismatched test certificate in an isolated environment. Record the final name and trust settings without publishing private certificate keys.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://developers.cloudflare.com/tunnel/troubleshooting/\">Cloudflare — Tunnel troubleshooting</a>. Reviewed October 14, 2026.</p>",
        "content_text": "Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.\nSource facts\nCloudflare’s troubleshooting guide describes different x509 failures between cloudflared and an HTTPS origin. A certificate valid for a different name calls for checking the expected server name, including originServerName. An unknown-authority error calls for reviewing trust, with caPool available for the relevant CA material. The guide also describes noTLSVerify as disabling certificate verification; that setting changes what cloudflared validates.\nSource: Cloudflare — Tunnel troubleshooting.\nApplicability\nThis article concerns the tunnel-to-origin HTTPS connection. Record the exact error and origin service before applying a remedy to another TLS connection in the request path.\nDSE recommendation\nDSE recommends collecting the origin address, configured expected name, certificate names, issuer chain, validity period, and tunnel configuration in a sanitized diagnostic record. Correct the mismatch or trust configuration through the approved certificate process. Verify the CA through a trusted administrative channel before installing it. Keep certificate validation enabled in the accepted configuration rather than closing the issue after a bypass makes the page load. Preserve the previous configuration and a rollback path for the change window.\nVerification\nRepeat the application transaction with validation enabled, then confirm that the original x509 error is resolved. Where safely testable, verify rejection of an intentionally mismatched test certificate in an isolated environment. Record the final name and trust settings without publishing private certificate keys.\nOfficial reference\nCloudflare — Tunnel troubleshooting. Reviewed October 14, 2026.",
        "content_markdown": "Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.\n\n## Source facts\n\nCloudflare’s troubleshooting guide describes different x509 failures between cloudflared and an HTTPS origin. A certificate valid for a different name calls for checking the expected server name, including originServerName. An unknown-authority error calls for reviewing trust, with caPool available for the relevant CA material. The guide also describes noTLSVerify as disabling certificate verification; that setting changes what cloudflared validates.\n\nSource: [Cloudflare — Tunnel troubleshooting](https://developers.cloudflare.com/tunnel/troubleshooting/).\n\n## Applicability\n\nThis article concerns the tunnel-to-origin HTTPS connection. Record the exact error and origin service before applying a remedy to another TLS connection in the request path.\n\n## DSE recommendation\n\nDSE recommends collecting the origin address, configured expected name, certificate names, issuer chain, validity period, and tunnel configuration in a sanitized diagnostic record. Correct the mismatch or trust configuration through the approved certificate process. Verify the CA through a trusted administrative channel before installing it. Keep certificate validation enabled in the accepted configuration rather than closing the issue after a bypass makes the page load. Preserve the previous configuration and a rollback path for the change window.\n\n## Verification\n\nRepeat the application transaction with validation enabled, then confirm that the original x509 error is resolved. Where safely testable, verify rejection of an intentionally mismatched test certificate in an isolated environment. Record the final name and trust settings without publishing private certificate keys.\n\n## Official reference\n\n[Cloudflare — Tunnel troubleshooting](https://developers.cloudflare.com/tunnel/troubleshooting/). Reviewed October 14, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/",
                "url": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-14"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Keep origin certificate validation while troubleshooting cloudflared",
                        "item": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/#article",
                "identifier": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/",
                "url": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/",
                "headline": "Keep origin certificate validation while troubleshooting cloudflared",
                "description": "Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.",
                "abstract": "Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.",
                "articleBody": "Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.\nSource facts\nCloudflare’s troubleshooting guide describes different x509 failures between cloudflared and an HTTPS origin. A certificate valid for a different name calls for checking the expected server name, including originServerName. An unknown-authority error calls for reviewing trust, with caPool available for the relevant CA material. The guide also describes noTLSVerify as disabling certificate verification; that setting changes what cloudflared validates.\nSource: Cloudflare — Tunnel troubleshooting.\nApplicability\nThis article concerns the tunnel-to-origin HTTPS connection. Record the exact error and origin service before applying a remedy to another TLS connection in the request path.\nDSE recommendation\nDSE recommends collecting the origin address, configured expected name, certificate names, issuer chain, validity period, and tunnel configuration in a sanitized diagnostic record. Correct the mismatch or trust configuration through the approved certificate process. Verify the CA through a trusted administrative channel before installing it. Keep certificate validation enabled in the accepted configuration rather than closing the issue after a bypass makes the page load. Preserve the previous configuration and a rollback path for the change window.\nVerification\nRepeat the application transaction with validation enabled, then confirm that the original x509 error is resolved. Where safely testable, verify rejection of an intentionally mismatched test certificate in an isolated environment. Record the final name and trust settings without publishing private certificate keys.\nOfficial reference\nCloudflare — Tunnel troubleshooting. Reviewed October 14, 2026.",
                "datePublished": "2026-10-15T00:43:25+00:00",
                "dateModified": "2026-10-15T00:44:33+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/cloudflared-origin-tls-name-ca-troubleshooting/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Keep origin certificate validation while troubleshooting cloudflared"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 238,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Cloudflare — Tunnel troubleshooting",
                    "url": "https://developers.cloudflare.com/tunnel/troubleshooting/"
                }
            }
        ]
    }
}