Got a Docker Compose file? Your project goes live in seconds — one command on cdn.com.tr. See how Built your app with AI? From folder to live URL with one command — no git, no registry: cdnctl deploy. See how Code on GitHub? Every push auto-deploys to cdn.com.tr — connect your repo and ship. See how Start free trial

CDN.com.tr Help

Authenticated origin pull (mTLS): accept only CDN.com.tr at your origin

Our edge servers present a client certificate when they connect to your origin. Your origin requires it and accepts only the name you pin: the CDN.com.tr certificate on every paid plan, or a certificate for your account only on Enterprise plans. The edges can also verify your origin's certificate.

Delivery points and DNS

Authenticated origin pull (mTLS): accept only CDN.com.tr at your origin

Our edge servers present a client certificate when they connect to your origin. Your origin requires it and accepts only the name you pin: the CDN.com.tr certificate on every paid plan, or a certificate for your account only on Enterprise plans. The edges can also verify your origin's certificate.

Use cases

A company keeps its origin reachable on the internet but wants it to answer only requests that come through its own CDN.com.tr account, without maintaining a list of edge addresses.

Workflow

  1. Make sure your origin answers HTTPS on a port of its own: on the Origin page, the HTTPS port must differ from the HTTP port.
  2. On the Origin page, open Authenticated origin pull (mTLS) and choose CDN.com.tr certificate (paid plans) or Certificate for this account only (Enterprise). Save.
  3. For the account certificate, wait until the card no longer says it is being installed: the certificate is placed on every edge server of your account first, then switched on by itself.
  4. Download the CA bundle (cdn-com-tr-origin-pull-ca.pem) from the card and configure your web server to require a client certificate signed by it, accepting only the name shown under Name to accept (CN): your account ID for the account certificate, origin-pull.cdn.com.tr for the CDN.com.tr certificate.
  5. Optionally switch on Verify the origin certificate: the edge then accepts only a valid certificate for your origin hostname (for an IP origin, the name you enter), issued by a public authority or by your own authority (paste its certificate).

Checks

  • While this is on, the edges connect to your origin over HTTPS for HTTP visitors too, on your origin's HTTPS port.
  • The CDN.com.tr certificate proves that a request comes from CDN.com.tr, not that it comes from your account: keep your secret header (for example X-CDN-Auth) with it. The account certificate (CN = your account ID) is issued for your account only.
  • Pin the name (CN), never the certificate fingerprint: the certificates are renewed automatically before they expire, the name stays the same.
  • Image optimization keeps working: our optimization servers present the same certificate when they fetch your originals.
  • When your origin requires a certificate and gets none, nginx answers 400; Apache, Caddy and IIS end the connection, which the visitor sees as 502. Switch the requirement on only after the edges present the certificate.
  • With verification on, a certificate that is expired, self-signed without your authority, or issued for another name makes the request fail with 502.

Frequently asked questions

How do I require the certificate in nginx?

In the server block that serves the CDN: ssl_client_certificate /etc/nginx/cdn-com-tr-origin-pull-ca.pem;, ssl_verify_client on;, ssl_verify_depth 2; and if ($ssl_client_s_dn !~ "(^|,)CN=<account-id>(,|$)") { return 403; }. With the CDN.com.tr certificate, write origin-pull\.cdn\.com\.tr in place of <account-id> and keep your X-CDN-Auth check.

How do I require it in Apache?

In the HTTPS virtual host: SSLCACertificateFile /etc/ssl/cdn-com-tr-origin-pull-ca.pem, SSLVerifyClient require, SSLVerifyDepth 2, then inside <Location "/"> the line Require expr %{SSL_CLIENT_S_DN_CN} == "<account-id>".

How do I require it in Caddy?

In your site block: tls { client_auth { mode require_and_verify trust_pool file /etc/caddy/cdn-com-tr-origin-pull-ca.pem } }, then @notcdn not expression {http.request.tls.client.subject}.matches("(^|,)CN=<account-id>(,|$)") and respond @notcdn 403. trust_pool file needs Caddy 2.8 or later.

How do I require it in IIS?

Import the CA bundle into the Local Computer's Trusted Root Certification Authorities (the root) and Intermediate Certification Authorities (the intermediate). In the site's SSL Settings, tick Require SSL and set Client certificates to Require. Then, in Configuration Editor under system.webServer/security/authentication/iisClientCertificateMappingAuthentication, enable it and add a one-to-many mapping with a rule: certificateField Subject, certificateSubField CN, matchCriteria <account-id>.

Do I still need the secret header?

With the CDN.com.tr certificate, yes: every CDN.com.tr account presents the same certificate, the header tells your requests apart. With the account certificate the CN check already accepts only your account; keeping the header too does no harm.

What happens when the certificate is renewed?

Nothing on your side. Certificates are renewed on our edge servers before they expire, from the same authority and with the same name, so a check on the name (CN) keeps passing.

Related pages

Manage DNS records

Add, update, delete, import, export, and move eligible records to cloud DNS.

HTTP/3 and IPv6 at the edge

Since September 2026 the CDN.com.tr edge serves every hostname over HTTP/3 (QUIC) and IPv6 in addition to HTTP/2 and IPv4. Browsers switch on their own; there is no per-account setting, and your origin can stay IPv4-only.