# agent's TLS check passed on the CDN edge but failed on origin: how to compare

## TL;DR

The CDN edge terminates TLS correctly, but the origin behind it has a broken cert, so the edge-to-origin hop is insecure or failing. Check the origin directly (bypassing the CDN), fix its cert, and monitor origin TLS separately. Edge TLS is not origin TLS.

```text
agent's TLS check passed on the CDN edge but failed on origin
```

## Steps

1. Check the origin directly: resolve the origin host and test TLS against it, bypassing the CDN.
   Expected: The origin failure is visible.

2. Fix the origin cert: valid chain, correct hostname, not expired.
   Expected: The origin serves clean TLS.

3. Set the CDN's origin pull to require valid TLS (Full Strict, not Flexible).
   Expected: The edge enforces origin TLS.

4. Monitor origin TLS independently of edge TLS.
   Expected: The two are never confused again.

5. Verify the full chain from a client through the edge to the origin.
   Expected: End-to-end TLS is proven.

## When to use

- TLS checks pass at the edge but fail at origin
- using a CDN with origin pull
- the CDN is in Flexible mode

## When not to use

- origin TLS is intentionally off (then use Full Strict deliberately, not Flexible)
- the check already covers origin (verify what it actually tests)
- there is no CDN (then it is just a TLS problem)

## Tool compatibility

- any CDN (Cloudflare, CloudFront, Fastly)
- origin TLS

## Variant phrasings

- "TLS passed CDN edge failed origin"
- "origin TLS broken CDN"
- "CDN edge vs origin TLS check"

## Why it happens

CDNs terminate client TLS at the edge, and the edge-to-origin connection is a separate TLS session with its own cert. Checks that only test the edge miss origin problems entirely, and Flexible mode hides them by allowing HTTP to the origin. The user sees a padlock while the back half is broken.

## Edge cases

- Flexible mode is the usual hider; Full Strict is the fix
- origin certs need the origin's hostname, not the public one
- monitor both; edge and origin expire independently

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_MNzo4XZRzetX6ZwqZoh8rA