{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "item": { "id": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "slug": "plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates", "url": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates.md", "json": "https://update.dsesecurity.com/api/v1/posts/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/" }, "title": "Plan direct-access behavior before using Cloudflare Origin CA certificates", "summary": "A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:17:03+00:00", "modified_at": "2026-10-20T18:34:37+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 268, "potentially_affected": "This concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.", "dse_recommendation": "DSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer.", "primary_source": { "name": "Cloudflare — Cloudflare origin CA", "url": "https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.

\n

Source facts

\n

Cloudflare documents Origin CA certificates for the connection between its proxy and an origin. It warns that pausing Cloudflare or disabling proxying can expose visitors to untrusted-certificate errors because ordinary browsers do not use that origin-only trust model. The source also states that Origin CA expiry notifications are not currently sent, requiring independent inventory or monitoring.

\n

Source: Cloudflare — Cloudflare origin CA.

\n

Applicability

\n

This concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.

\n

DSE recommendation

\n

DSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer. If it is required, prepare an appropriate publicly trusted certificate or another supported recovery method rather than assuming proxy removal is transparent. Track origin certificate expiry independently and assign a renewal owner. Keep the private key outside public web paths and do not copy it into support evidence. Mark emergency direct access as supported, deliberately unavailable, or unresolved in the recovery plan. Ask the website owner to demonstrate the chosen recovery path without trust warnings. Include expiry ownership in that same review so an origin-only certificate is not omitted from the normal renewal inventory.

\n

Verification

\n

Inspect the origin certificate and test the normal proxied website path. In an isolated or controlled recovery rehearsal, verify the planned direct-access method with normal trust validation and the correct hostname. Confirm the expiry-monitoring path reaches the responsible team, recording certificate metadata without exposing key material or disabling browser warnings.

\n

Official reference

\n

Cloudflare — Cloudflare origin CA. Reviewed October 20, 2026.

", "content_text": "A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.\nSource facts\nCloudflare documents Origin CA certificates for the connection between its proxy and an origin. It warns that pausing Cloudflare or disabling proxying can expose visitors to untrusted-certificate errors because ordinary browsers do not use that origin-only trust model. The source also states that Origin CA expiry notifications are not currently sent, requiring independent inventory or monitoring.\nSource: Cloudflare — Cloudflare origin CA.\nApplicability\nThis concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.\nDSE recommendation\nDSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer. If it is required, prepare an appropriate publicly trusted certificate or another supported recovery method rather than assuming proxy removal is transparent. Track origin certificate expiry independently and assign a renewal owner. Keep the private key outside public web paths and do not copy it into support evidence. Mark emergency direct access as supported, deliberately unavailable, or unresolved in the recovery plan. Ask the website owner to demonstrate the chosen recovery path without trust warnings. Include expiry ownership in that same review so an origin-only certificate is not omitted from the normal renewal inventory.\nVerification\nInspect the origin certificate and test the normal proxied website path. In an isolated or controlled recovery rehearsal, verify the planned direct-access method with normal trust validation and the correct hostname. Confirm the expiry-monitoring path reaches the responsible team, recording certificate metadata without exposing key material or disabling browser warnings.\nOfficial reference\nCloudflare — Cloudflare origin CA. Reviewed October 20, 2026.", "content_markdown": "A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.\n\n## Source facts\n\nCloudflare documents Origin CA certificates for the connection between its proxy and an origin. It warns that pausing Cloudflare or disabling proxying can expose visitors to untrusted-certificate errors because ordinary browsers do not use that origin-only trust model. The source also states that Origin CA expiry notifications are not currently sent, requiring independent inventory or monitoring.\n\nSource: [Cloudflare — Cloudflare origin CA](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/).\n\n## Applicability\n\nThis concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.\n\n## DSE recommendation\n\nDSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer. If it is required, prepare an appropriate publicly trusted certificate or another supported recovery method rather than assuming proxy removal is transparent. Track origin certificate expiry independently and assign a renewal owner. Keep the private key outside public web paths and do not copy it into support evidence. Mark emergency direct access as supported, deliberately unavailable, or unresolved in the recovery plan. Ask the website owner to demonstrate the chosen recovery path without trust warnings. Include expiry ownership in that same review so an origin-only certificate is not omitted from the normal renewal inventory.\n\n## Verification\n\nInspect the origin certificate and test the normal proxied website path. In an isolated or controlled recovery rehearsal, verify the planned direct-access method with normal trust validation and the correct hostname. Confirm the expiry-monitoring path reaches the responsible team, recording certificate metadata without exposing key material or disabling browser warnings.\n\n## Official reference\n\n[Cloudflare — Cloudflare origin CA](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "url": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Plan direct-access behavior before using Cloudflare Origin CA certificates", "item": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/#article", "identifier": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "url": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/", "headline": "Plan direct-access behavior before using Cloudflare Origin CA certificates", "description": "A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.", "abstract": "A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.", "articleBody": "A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.\nSource facts\nCloudflare documents Origin CA certificates for the connection between its proxy and an origin. It warns that pausing Cloudflare or disabling proxying can expose visitors to untrusted-certificate errors because ordinary browsers do not use that origin-only trust model. The source also states that Origin CA expiry notifications are not currently sent, requiring independent inventory or monitoring.\nSource: Cloudflare — Cloudflare origin CA.\nApplicability\nThis concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.\nDSE recommendation\nDSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer. If it is required, prepare an appropriate publicly trusted certificate or another supported recovery method rather than assuming proxy removal is transparent. Track origin certificate expiry independently and assign a renewal owner. Keep the private key outside public web paths and do not copy it into support evidence. Mark emergency direct access as supported, deliberately unavailable, or unresolved in the recovery plan. Ask the website owner to demonstrate the chosen recovery path without trust warnings. Include expiry ownership in that same review so an origin-only certificate is not omitted from the normal renewal inventory.\nVerification\nInspect the origin certificate and test the normal proxied website path. In an isolated or controlled recovery rehearsal, verify the planned direct-access method with normal trust validation and the correct hostname. Confirm the expiry-monitoring path reaches the responsible team, recording certificate metadata without exposing key material or disabling browser warnings.\nOfficial reference\nCloudflare — Cloudflare origin CA. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:17:03+00:00", "dateModified": "2026-10-20T18:34:37+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Plan direct-access behavior before using Cloudflare Origin CA certificates" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 268, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Cloudflare origin CA", "url": "https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/" } } ] } }