CDN to Origin Certificates: Your Own CA with OpenSSL

Tue, 15 Jul 2025 00:00:00 +0000

There’s a common assumption that because a CDN handles the TLS connection your users see — the certificate shown in the browser’s address bar — you don’t need to think too hard about certificates on your origin. That’s wrong, and the consequences show up as cryptic error codes rather than obvious failures.

A CDN like Akamai doesn’t act as a transparent tunnel. It terminates the TLS session from the client, inspects and processes the request, then opens a new TLS session toward your origin. Two separate connections, two separate certificate validations.

TLS on Eknix — Web security & performance for the enterprise

CDN to Origin Certificates: Your Own CA with OpenSSL