Set up Authenticated Origin Pulls

To set up Authenticated Origin Pulls - which help ensure requests to your origin server come from the Cloudflare network - choose whether to enable them on all hostnames in your zone or on a per-hostname basis.

​​ Other situations

​​ Use specialized certificates

To apply different client certificates simultaneously at both the zone and hostname level, you can combine zone-level and per-hostname custom certificates.

First set up zone-level pulls using a certificate. Then, upload multiple, specialized certificates for individual hostnames.

​​ Delete a certificate

Client certificates are not deleted from Cloudflare upon expiration unless a delete Open API docs link or replace Open API docs link request is sent to the Cloudflare API.

However, requests are dropped at your origin if your origin only accepts a valid client certificate.

​​ Replace a client cert (without downtime)

For hostname:

1. Upload the new certificate Open API docs link .

2. Enable Authenticated Origin Pulls for that specific hostname Open API docs link .

For global:

1. Upload the new certificate Open API docs link .

2. Check whether new certificate is Active Open API docs link .

3. Once certificate is active, delete the previous certificate Open API docs link .