{"id":2733,"date":"2019-10-23T10:54:12","date_gmt":"2019-10-23T02:54:12","guid":{"rendered":"https:\/\/www.mondoze.com\/guide\/?post_type=kb&#038;p=2733"},"modified":"2022-10-05T08:02:02","modified_gmt":"2022-10-05T00:02:02","slug":"using-railgun-with-origin-ca-certificates","status":"publish","type":"kb","link":"https:\/\/www.mondoze.com\/guide\/kb\/using-railgun-with-origin-ca-certificates","title":{"rendered":"Using Railgun with Origin CA Certificates"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2733\" class=\"elementor elementor-2733\" data-elementor-settings=\"[]\">\n\t\t\t\t\t\t<div class=\"elementor-inner\">\n\t\t\t\t\t\t\t<div class=\"elementor-section-wrap\">\n\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-797bb0d5 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"797bb0d5\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t\t\t<div class=\"elementor-row\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6763efc3\" data-id=\"6763efc3\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-column-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-05f7434 elementor-widget elementor-widget-heading\" data-id=\"05f7434\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How To Use Railgun with Origin CA Certificates<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b76668 elementor-widget elementor-widget-text-editor\" data-id=\"8b76668\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-text-editor elementor-clearfix\">\n\t\t\t\t<p>While using Railgun and configuring Origin CA certificates, please note that additional steps are need to avoid service impact for HTTPS requests being sent from the Listener. To the site&#8217;s origin (where the origin CA certificates are install).\u00a0<\/p><p>This is due to the default that trust to store that is ship with the Railgun listener. Being a identical copy of the root certificates that it trusts (identical to what NSS\/Mozilla trusts).<\/p><p>This means that when enabling Full SSL (Strict) in the dashboard while Railgun is enable.The Listener will no longer consider the origin presenting the Origin CA certificate as trustworthy. Resulting in a 520 error.<\/p><p>* Please note that this error condition will only occur if <code>validate.cert<\/code>\u00a0is enabled (i.e. set to 1) from the\u00a0<code>railgun.conf<\/code>\u00a0file.<\/p><p>Here is an example of the error generated when\u00a0<code>validate.cert = 1<\/code>, the origin uses an Origin CA leaf, and the Origin CA roots are not in the trust store for Railgun specified by ca.bundle:<\/p><pre>rg-listener: [2a074d8b36f00000-ATL] www.example.com origin request failed 123.123.123.123:443 to %!!(MISSING)s(MISSING): x509: certificate signed by unknown authority<\/pre><p>Here are the following options available to avoid these errors:<\/p><p>1. \u00a0 \u00a0Set\u00a0<code>validate.cert = 0<\/code>\u00a0in the\u00a0<code>railgun.conf<\/code>\u00a0file<\/p><p>2. Add Cloudflare&#8217;s origin CA root certificates to the trust store specified in the <code>ca.bundle<\/code>\u00a0parameter in the\u00a0<code>railgun.conf<\/code>. This can be done by a simply adding these root certificates at the end of the file using a text editor.<\/p><p>By default, railgun.conf defines the Listener&#8217;s trust store as (for Debian\/Ubuntu):<br \/><code>ca.bundle = \/etc\/ssl\/railgun-ca-certs.crt<\/code><\/p><p>*As a reminder, the listener will need to be restart after making changes to the configuration file.<\/p>\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>How To Use Railgun with Origin CA Certificates While using Railgun and configuring Origin CA certificates, please note that additional steps are need to avoid service impact for HTTPS requests being sent from the Listener. To the site&#8217;s origin (where the origin CA certificates are install).\u00a0 This is due to the default that trust to &hellip;<\/p>\n<p class=\"read-more\"> <a class=\"\" href=\"https:\/\/www.mondoze.com\/guide\/kb\/using-railgun-with-origin-ca-certificates\"> <span class=\"screen-reader-text\">Using Railgun with Origin CA Certificates<\/span> Read More \u00bb<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}}},"kbtopic":[53],"kbtag":[110],"mkb_version":[],"_links":{"self":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb\/2733"}],"collection":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb"}],"about":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/types\/kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/comments?post=2733"}],"version-history":[{"count":6,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb\/2733\/revisions"}],"predecessor-version":[{"id":18791,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kb\/2733\/revisions\/18791"}],"wp:attachment":[{"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/media?parent=2733"}],"wp:term":[{"taxonomy":"kbtopic","embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kbtopic?post=2733"},{"taxonomy":"kbtag","embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/kbtag?post=2733"},{"taxonomy":"mkb_version","embeddable":true,"href":"https:\/\/www.mondoze.com\/guide\/wp-json\/wp\/v2\/mkb_version?post=2733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}