The origin protocol policy specifies the protocol a point of presence (POP) uses to fetch resources from an origin server. After you configure this feature, POPs fetch resources from the origin server using the specified protocol. You can also set custom ports for HTTP and HTTPS.
Feature overview
By default, the origin protocol policy feature is disabled. When this feature is disabled, the protocol for origin requests depends on the origin port that you set when you configure an origin server:
If the origin port is set to 443, POPs fetch resources over HTTPS.
If the origin port is set to 80 or another port, POPs fetch resources over HTTP.
After you configure the origin protocol policy, POPs fetch resources based on the specified protocol:
HTTP: POPs always use HTTP to fetch resources from the origin server.
HTTPS: POPs always use HTTPS to fetch resources from the origin server.
Follow:
If a user accesses CDN over HTTP, the POP uses HTTP to fetch resources from the origin server.
If a user accesses CDN over HTTPS, the POP uses HTTPS to fetch resources from the origin server.
HTTPS is designed to prevent data from being modified or recorded during transmission. HTTPS encryption consumes additional processing resources on your origin server. If you need to transmit only sensitive data, such as user authentication information, over HTTPS and use HTTP for non-sensitive data, such as images, we recommend that you set the origin protocol policy to Follow.
Relationship between origin Host and origin SNI
When you set the origin protocol policy to HTTPS, we recommend that you also check the default origin Host and origin SNI configurations. In scenarios where an origin server hosts multiple domains (for example, multiple HTTPS sites are deployed on a single server), a POP requires the correct Host header and SNI value to route an HTTPS origin request to the intended site:
Origin Host: Determines the value of the Host header in the HTTP request sent to the origin server. You can configure this in the Default Origin Host section by selecting accelerated domain name, origin domain name, or a custom domain.
Origin SNI: Determines the SNI value sent during the TLS handshake for an origin request. You can configure this in the origin SNI section by enabling the feature and providing an SNI value.
Recommendation: When configuring HTTPS for origin requests, especially on port 443, set both the origin Host and origin SNI to either the accelerated domain name or the origin domain name. If either setting is incorrect, origin request failures such as Bad Request or 502 errors can occur.
Procedure
-
Log on to the CDN console.
-
In the left navigation pane, click Domain Names.
-
On the Domain Names page, find the target domain name and click Manage in the Actions column.
-
In the domain's navigation pane, click Origin Fetch.
In the Origin Protocol Policy section, turn on the Origin Protocol Policy switch.
In the Static Origin Protocol Policy dialog box, select a policy type: Follow, HTTP, or HTTPS.
NoteFor HTTP origin requests, port 80 is used by default. You can specify a custom port by configuring the HTTP Port.
For HTTPS origin requests, port 443 is used by default. You can specify a custom port by configuring the HTTPS Port.
Custom origin ports
Port range: The valid range for both HTTP Port and HTTPS Port is 1 to 65535.
Client access port limits: Client requests to CDN can only use standard ports (HTTP 80 and HTTPS 443). You cannot directly access an accelerated domain name by using a non-standard port such as 8080 or 60080. Custom origin ports are used only for connections between POPs and your origin server.
Use case: If your origin server listens for HTTP or HTTPS services on a non-standard port, such as 8150 or 60080, you must do the following:
In the Origin Protocol Policy section, turn on the switch.
Set the policy type to HTTP or HTTPS to match the protocol your origin server listens on.
In the corresponding port field, enter the custom port number that your origin server listens on.
Important: The origin protocol policy must match the protocol that your origin server uses:
Origin protocol policy
Certificate required for origin server
Description
HTTPS (port 443 or a custom HTTPS port)
Required
CDN performs a TLS handshake with the origin server and validates the certificate. If the certificate is invalid or expired, the origin fetch fails.
HTTP (port 80 or a custom HTTP port)
No
CDN communicates with the origin server over HTTP and does not validate certificates. Even when HTTPS is enabled on CDN, only the certificate for the client-to-CDN connection requires maintenance.
Click OK.