CDN:Configure an origin

Origin traffic fees

When Alibaba Cloud CDN retrieves resources from an origin (origin fetch), the traffic generates outbound bandwidth fees on the origin side, and you are charged for that traffic. For example, an IDC origin generates IDC bandwidth fees, and an OSS origin generates OSS traffic fees.

Traffic discount information for Alibaba CloudCDN when it performs origin fetches from Alibaba Cloud OSS:

• In the Alibaba CloudCDN console, set the origin type to OSS Domain. Alibaba Cloud OSS then identifies origin fetch traffic from the Alibaba CloudCDN product as "CDN back-to-origin traffic", making it eligible for a more favorable price.

• If you mistakenly set the origin type to Site Domain in the Alibaba CloudCDN console, Alibaba Cloud OSS identifies origin fetch traffic from the Alibaba CloudCDN product as "Internet outbound traffic", and the discounted price does not apply. For detailed billing information, see Billing of OSS content acceleration.

Add or modify origin information

Before you configure an origin, ensure that the following requirements are met:

• If you use Alibaba Cloud OSS as the origin, you must Configure default origin host, and set the default origin Host header to the public endpoint of the OSS bucket. Otherwise, the origin cannot be accessed.

• If you configure an OSS domain from another Alibaba Cloud account, ensure that the current account, or the AccessKey of the Resource Access Management (RAM) user in use, has the required access permissions for the bucket. Otherwise, origin fetch fails because authentication fails.

• If you configure an IPv6 origin address, enable origin fetch over IPv6 in advance. Otherwise, the configured IPv6 origin address does not take effect, which causes origin fetch failures. For more information, see Configure Origin Fetch over IPv6.

• If the origin domain name contains Chinese characters, complete the required filing for the Chinese domain name, and then use the third-party tool punycode to convert it into an English domain name, for example, xn--fiq****.xn--eq****, before you enter it.

• (Recommended) If you use Alibaba Cloud OSS as the origin, configure default origin SNI, and set the default origin SNI to the public endpoint of the OSS bucket. Otherwise, OSS may throttle requests.

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the Origin Information section, add or modify the origin configuration as needed.

   • Click Add Origin Server to add an origin.

   • Click Edit next to existing origin information to modify the origin configuration.

   Parameter	Description
   Origin Info	Select the origin type and enter the origin address. OSS Domain: Select or enter the public endpoint of an Alibaba Cloud OSS bucket. IP: Enter one or more IP addresses. Site Domain: Enter one or more domain names. Function Compute Domain: Select a Function Compute domain name. For details about each origin type, see the origin type details below.
   Priority	Assign different priorities to origins to implement primary/secondary failover. The primary priority is higher than the secondary priority. When a user request performs origin fetch through Alibaba CloudCDN , the request is first sent to an origin address with the primary priority. If the primary origin fails because the TCP connection between the CDN point of presence and the origin fails, the request is sent to the secondary origin. Valid values: 0 to 127. A smaller value indicates a higher priority. Default value: 20 for a primary origin and 30 for a secondary origin. To configure another value, submit a ticket. For example, if origin A has the primary priority and origin B has the secondary priority, a user request that performs origin fetch through Alibaba CloudCDN is sent to origin A first. If origin A fails because the TCP connection between the CDN point of presence and the origin fails, the request is sent to origin B. When origin A recovers, requests switch from origin B back to origin A.
   Weight	Assign the same priority and different weights to origins to implement weighted load balancing. When multiple origins have the same priority, Alibaba CloudCDN distributes the proportion of user requests sent to different origins according to their weights. You can set weights as needed. Valid values: 1 to 100. A larger value means that the origin receives a higher proportion of user requests. Default value: 10. For example, if origins A and B both have the primary priority, origin A has a weight of 80, and origin B has a weight of 20, user requests are distributed between origins A and B at a ratio of 8:2. In some cases, the actual ratio of user requests that perform origin fetch to different origins might not equal the origin weight ratio configured for the domain name. For example: The origin fetch QPS is low, for example, less than 10 QPS. The probability distribution of origin fetches to different origins is uneven, which can cause the actual origin fetch weight to differ from the configured origin weight. All requests originate from a single IP address, or a limited number of IP addresses. Because the same IP address is scheduled to the same CDN point of presence and TCP session persistence exists between the CDN point of presence and the origin, most requests might be sent to the same origin. To verify that the actual user request origin fetch weights approximately match the origin weights configured for the domain name, use a third-party network probing tool to create a probe task. Configure probe clients across as many geographic locations and Internet service providers as possible, and run the probe task long enough to collect sufficient valid probe data.
   Port	Specifies the port through which the CDN point of presence requests resources from the origin. Based on what your origin supports, you can specify a custom origin fetch port from 1 to 65535. Default value: 80. A port value of 443 uses HTTPS for origin fetch. Port 80 or another custom port uses HTTP for origin fetch. Note To use HTTPS for origin fetch through another custom port, see Configure the origin protocol policy. If you configure the Origin Protocol Policy feature, which is disabled by default, the port configured here does not take effect. To disable the origin protocol policy, see Configure the origin protocol policy. When the origin is an OSS domain, whether custom ports are supported for origin fetch depends on OSS.

5. Click OK to complete the configuration.

OSS Domain

• Method 1: Select the public endpoint of an OSS bucket in the same account from the drop-down list as the origin.

• Method 2: Manually enter the public endpoint of an Alibaba Cloud OSS bucket as the origin. OSS internal endpoints are not supported. An example OSS public endpoint is ***.oss-cn-hangzhou.aliyuncs.com. You can view it in the OSS console.

• For best practices for accelerating OSS resources, see Accelerate OSS resource delivery.

IP

• You can configure one or more IP addresses as origin addresses. Private IP addresses are not supported.

• IPv4 addresses and IPv6 addresses are supported, but you cannot configure only IPv6 addresses. At least one IPv4 address is required.

• When you use the public IP address of an Alibaba Cloud ECS instance as the origin address, review is not required.

• For best practices for configuring IP addresses as the origin type, see Accelerate ECS resources with CDN.

Site Domain

• You can configure one or more domain names as origin addresses.

• For best practices for configuring domain names as the origin type, see Accelerate ECS resources with CDN.

• Origin domain name format:

  • The domain name must contain 1 to 67 characters.

  • Supported characters: lowercase letters (a to z), digits (0 to 9), and hyphens (-), for example, example.com.

  • Unsupported characters: Chinese characters, uppercase letters (A to Z), and symbols other than hyphens (-). Hyphens (-) cannot appear consecutively, cannot be used alone, and cannot appear at the beginning or end of the domain name.

Function Compute Domain

You can configure as an origin address a Function Compute domain name that you configured in Function Compute under the same account. Select the Function Compute Region and Domain Name. For instructions, see Configure a custom domain name.

Use ALB as the origin

You can directly add the instance address of an Alibaba Cloud ALB product, for example, example.hangzhou.alb.aliyuncs.com, as the origin. In a CDN + ALB architecture, configure DNS resolution and the origin as follows:

• At your DNS provider, resolve the accelerated domain name by CNAME to the CNAME address assigned by CDN. You can obtain the CNAME address on the Domain Names page in the CDN console.

• In the CDN console, set the origin type to Site Domain and enter the domain name of the ALB instance as the origin address.

After configuration, the user request path is: client → CDN → ALB → backend server. Do not resolve the domain name directly to ALB. Otherwise, CDN acceleration does not take effect.

Resolve the RetErrorSourceCircle error

When you add an origin, if the origin domain name that you enter is already configured as a CDN accelerated domain name, whether in the current account or another account, the system returns the RetErrorSourceCircle error code. This prevents a circular origin fetch loop between CDN points of presence (CDN → CDN → …), which would prevent requests from reaching the actual origin. Resolve this issue in one of the following ways:

• Obtain the IP address of the origin server, change the origin type to IP, and set the origin Host header to the original domain name in the origin fetch configuration.

• If the domain name is configured as an accelerated domain name in the current account and you can accept the loss of CDN acceleration, delete the CDN acceleration configuration for that domain name in the current account. Wait a few minutes for the change to take effect, and then add the domain name as the origin again.

• If the domain name is configured as an accelerated domain name in another account, verify domain ownership through a TXT record, migrate the domain name to the current account, and then configure the origin again.

Origin retry, origin timeouts, and origin probing

Retry rules

• Retry order

  • Retry the origin addresses in the origin address list for the basic domain information in descending priority order.

  • If origin addresses have the same priority, retry them according to their weight ratio.

• Retry granularity

  • Retries occur at the IP address level. If the origin is a domain name, all IP addresses resolved from that domain name are retried. Another available origin is accessed only after all IP addresses under the domain name fail to connect.

  • During retries, the system automatically filters out unavailable origins in the dead table.

• Retry status codes

  • The CDN point of presence retries when it receives a 5xx status code in the origin response.

• Retry timing

  • When the origin actively returns a retry status code, the CDN point of presence retries as soon as it receives that code.

  • If the origin does not actively return a retry status code, origin fetch timeout processing applies. When the timeout expires, the CDN point of presence retries.

Origin timeouts

• Origin TCP connection timeout: 10 seconds.

• Origin write timeout: 30 seconds by default. This is the timeout for writing content after the connection to the origin is established.

• Origin read timeout: 30 seconds by default. This applies when the origin does not fully return the content requested by the CDN point of presence within a specified period after the connection to the origin is established.

• You can adjust the origin write timeout and origin read timeout by configuring the origin HTTP request timeout.

Origin probing

• TCP connection exception: If the TCP connection between the CDN point of presence and an origin IP address is unavailable twice in a row because connection establishment fails or the connection times out, the CDN point of presence removes the origin IP address from the list of available origin addresses and adds it to the dead table. Subsequent origin fetch requests do not access that IP address. The CDN point of presence then probes the origin IP address by establishing a TCP connection every 5 seconds. If the connection succeeds, the origin IP address is restored to the list of available origin addresses.

• Normal TCP connection: If the TCP connection between the CDN point of presence and an origin IP address is normal but the origin returns a retry status code, such as 5xx, the retry logic is triggered. However, the origin IP address remains in the list of available origin addresses, and the next request is still sent to that origin according to its weight. In other words, when the Layer 4 TCP connection is normal, Layer 7 HTTP request exceptions do not automatically block the origin IP address. To actively block the origin IP address when Layer 7 HTTP request exceptions occur, submit a ticket to request the configuration.

References

• For information about origins, see Origin server.

• When you use multiple origins for acceleration, configure different origin Host headers to specify the origins from which CDN points of presence retrieve resources. For more information, see Configure default origin host.

• To customize the HTTP or HTTPS origin protocol policy, see Configure the origin protocol policy.

• If your origin uses Alibaba Cloud OSS and the OSS bucket is configured in private mode, enable private OSS bucket origin fetch for the accelerated domain name. For more information, see Configure origin fetch from a private OSS bucket.

• If the origin IP address is bound to multiple domain names and the CDN origin protocol policy is HTTPS, configure origin SNI. For more information, see Configure default origin SNI.

• For information about CDN origin fetch policies and rules, see Origin fetch.