CDN Mutual TLS: Two-Way Certificate Authentication

What Is Mutual TLS

In standard TLS, only the server presents a certificate. In mutual TLS (mTLS), both sides present certificates — the server authenticates to the client AND the client authenticates to the server. For CDNs, mTLS is used in two scenarios: CDN-to-origin authentication and client-to-CDN authentication. For foundational context, read CDN DDoS Protection: How CDNs Absorb Volumetric Attacks — FlyFish NWA.

CDN-to-Origin mTLS

The CDN presents a client certificate when connecting to your origin. Your origin verifies the certificate before accepting the connection. This ensures only authorized CDN servers can access your origin.

# CDN → Origin connection with mTLS:
1. CDN edge connects to origin
2. Origin sends its server certificate (standard TLS)
3. Origin requests client certificate (mTLS step)
4. CDN sends its client certificate
5. Origin verifies: Is this a valid CDN certificate?
6. If yes → connection established
7. If no → connection rejected

This is the strongest form of origin protection. Even if an attacker knows your origin IP, they can't connect without the CDN's client certificate.

Setting Up CDN-to-Origin mTLS

Cloudflare Authenticated Origin Pulls

1. Download Cloudflare's client certificate (origin-pull-ca.pem)
2. Configure your origin to require this certificate
3. Enable Authenticated Origin Pulls in Cloudflare dashboard

# Nginx origin configuration
server {
    listen 443 ssl;
    ssl_certificate /path/to/server.crt;
    ssl_certificate_key /path/to/server.key;

    ssl_client_certificate /path/to/cloudflare-origin-pull-ca.pem;
    ssl_verify_client on;
}

CloudFront Origin mTLS

CloudFront does not natively support mTLS to origin. Workaround: use Lambda@Edge to add a client certificate, or use a header-based authentication approach.

Client-to-CDN mTLS

The CDN requires clients to present certificates. Used for:

• API authentication — Machine-to-machine communication where each client has a unique certificate
• IoT devices — Devices authenticate with device certificates
• Corporate access — Employees use client certificates issued by the company CA

Certificate Management

mTLS adds certificate management overhead:

• Certificate rotation — Client certificates must be renewed before expiry. Plan for overlap periods where both old and new certificates are accepted.
• Revocation — When a certificate is compromised, you need CRL (Certificate Revocation List) or OCSP responders
• CA management — You operate or use a private Certificate Authority to issue client certificates
• Distribution — Client certificates must be securely distributed to authorized clients

mTLS vs Other Auth Methods

See token authentication and Zero Trust for complementary approaches.

Performance Impact

mTLS adds one additional round-trip to the TLS handshake (for client certificate exchange). With connection pooling between CDN and origin, this overhead is amortized across many requests. CDN-to-origin mTLS has negligible performance impact because CDN connections are persistent.