{"id":9,"date":"2026-02-25T15:33:42","date_gmt":"2026-02-25T15:33:42","guid":{"rendered":"http:\/\/wordpress\/?p=9"},"modified":"2026-03-03T01:48:49","modified_gmt":"2026-03-02T23:48:49","slug":"configuring-haproxy-to-use-aop-authorised-origin-pull","status":"publish","type":"post","link":"https:\/\/rokas.me\/index.php\/2026\/02\/25\/configuring-haproxy-to-use-aop-authorised-origin-pull\/","title":{"rendered":"Configuring HAProxy to use AOP (Authenticated Origin Pulls)"},"content":{"rendered":"\n<p>you get authenticated_origin_pull_ca.pem from <a href=\"https:\/\/developers.cloudflare.com\/ssl\/static\/authenticated_origin_pull_ca.pem\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/developers.cloudflare.com\/ssl\/static\/authenticated_origin_pull_ca.pem<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code alignwide\"><code>bind *:443 ssl crt \/etc\/haproxy\/ssl\/certs ca-file \/etc\/haproxy\/ssl\/authenticated_origin_pull_ca.pem verify optional<\/code><\/pre>\n\n\n\n<p>\/etc\/haproxy\/ssl\/certs is a directory containing pem files for your domains e.g. \/etc\/haproxy\/ssl\/certs\/simple.example.com.pem<\/p>\n\n\n\n<p>verify optional can be changed to verify required. This will force the client to provide a client certificate and if they don&#8217;t they get SSL handshake error.<\/p>\n\n\n\n<p>Lastly you need to enable this settings in the SSL\/TLS -&gt; Origin Server menu in the CloudFlare console  for your domain.<\/p>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a1cb47f6a609&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a1cb47f6a609\" class=\"wp-block-image size-full is-style-default wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1042\" height=\"238\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" data-id=\"10\" src=\"http:\/\/wordpress\/wp-content\/uploads\/2026\/02\/image.png\" alt=\"\" class=\"wp-image-10\" srcset=\"https:\/\/rokas.me\/wp-content\/uploads\/2026\/02\/image.png 1042w, https:\/\/rokas.me\/wp-content\/uploads\/2026\/02\/image-300x69.png 300w, https:\/\/rokas.me\/wp-content\/uploads\/2026\/02\/image-1024x234.png 1024w, https:\/\/rokas.me\/wp-content\/uploads\/2026\/02\/image-768x175.png 768w\" sizes=\"auto, (max-width: 1042px) 100vw, 1042px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/figure>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>you get authenticated_origin_pull_ca.pem from https:\/\/developers.cloudflare.com\/ssl\/static\/authenticated_origin_pull_ca.pem \/etc\/haproxy\/ssl\/certs is a directory containing pem files for your domains e.g. \/etc\/haproxy\/ssl\/certs\/simple.example.com.pem verify optional can be changed to verify required. This will force the client to provide a client certificate and if they don&#8217;t they get SSL handshake error. Lastly you need to enable this settings in the SSL\/TLS -&gt; [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":10,"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":105,"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/posts\/9\/revisions\/105"}],"wp:attachment":[{"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rokas.me\/index.php\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}