Previously we posted about the importance of ensuring that all traffic to your website is actually going via Cloudflare (if you use Cloudflare in this way).

Quick recap, why is this so important?

Unless you ensure this is the case a malicious actor could possibly reach your content/website via your server IP address. Ensuring that only traffic via Cloudflare is accepted secures your web site or app and means that other tools (like Cloudflare Access, Workers etc can work correctly) can also be used to enhance your security.

So, Authenticated Origin Pulls

In plain English, your web server presents a cryptographic signature and says that only if the visitor presents the other part of the certificate should they be allowed to load the web page. Your web server actually enforces this. This way, if traffic does not come from Cloudflare, it will be rejected.

Limitation: You will only be able to configure this if you have full access to your web server ie root access, VPS, dedicated server etc. A basic level of knowledge of server administration is required.

Setup

There are 3 steps involved. I’ll provide an example below for NGINX. Apache is just as easy.

1. In your Cloudflare dashboard enable Authenticated Origin Pulls, a quick link to this page in your account is here. Please note, enabling this now is a good idea, it will allow Cloudflare the few minutes it needs to start sending the one part of the cryptographic signature from all parts of their network. Until you start to enforce it (step 3) there will be no change or downtime on your web site.
2. Download the certificate Cloudflare provides for this purpose. You can find it here. Save this to your server, a good location is:
   
   /etc/ssl/certs/cloudflare.crt
   
   (other locations are probably quite acceptable)
3. Now update your Nginx configuration to use Authenticated Origin Pulls. Open the configuration file for your domain, or include the following:

ssl_client_certificate /etc/ssl/certs/cloudflare.crt;
ssl_verify_client on;

At this point, the moment you restart NGINX, your web server will ensure that only traffic via Cloudflare will be permitted.

Test

Test things by visiting your website directly via the IP address. You should see something like:

400 Bad Request

No required SSL certificate was sent

openresty

That’s it! A huge step in securing your server has now been completed. Any issues/questions please let us know in the comments below. Keep safe!