OriginCaCertificate

Source: src/Cloudflare/OriginCaCertificate/OriginCaCertificate.ts

A Cloudflare Origin CA certificate — a free certificate signed by Cloudflare’s Origin CA that encrypts traffic between Cloudflare’s edge and your origin server. Origin CA certificates are only trusted by Cloudflare (not by browsers), so they are used together with proxied DNS records.

You supply a CSR (keeping the private key to yourself); Cloudflare signs it synchronously and returns the certificate PEM. The endpoints are top-level (/certificates) — the zone is implied by the hostnames in the request, which must belong to zones on your account.

Certificates are fully immutable: there is no update API, so changing any property triggers a replacement (a new certificate is issued, then the old one is revoked). Destroying the resource revokes the certificate.

Issuing a certificate

RSA certificate for a single hostname

const cert = yield* Cloudflare.OriginCaCertificate.OriginCaCertificate("origin-cert", {
  csr: originCsrPem,
  hostnames: ["origin.example.com"],
  requestType: "origin-rsa",
  requestedValidity: 90,
});

Wildcard ECDSA certificate with the default 15-year validity

const cert = yield* Cloudflare.OriginCaCertificate.OriginCaCertificate("wildcard-cert", {
  csr: wildcardCsrPem,
  hostnames: ["example.com", "*.example.com"],
  requestType: "origin-ecc",
});

Using the certificate

// The signed certificate is returned synchronously on create:
const pem = cert.certificate; // "-----BEGIN CERTIFICATE-----\n..."
const expires = cert.expiresOn;