Verify that TLS peer certificates came from CloudFlare
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


CloudFlare has an Authenticated Origin Pulls mode where requests to your origin servers present a CloudFlare issued certificate. This module helps you verify requests to your Node server came from CloudFlare without needing to change how your own SSL certificate is served.

This module has been tested with Node.js 0.10 and above.

You may also be interested in securing access to your origin servers.


npm install --save cloudflare-origin-pull


You'll need to run an HTTPS server for this to work. In the example below that's done assuming a certificate in PKCS #12 format named my-cert.p12.

Add the requestCert option and set it to true. This causes your HTTPS server to request the peer certificate from CloudFlare.

Set rejectUnauthorized to false. This allows you to verify the peer certificate yourself.

req.client is a TLSSocket. getPeerCertificate() returns what we hope is CloudFlare's certificate.

The cloudflare-origin-pull module exports a verify() method. Call it with the peer certificate, if any. It verifies whether the certificate was issued by CloudFlare and if it has not yet expired, returning a boolean. verify() does not throw errors and can be called without a certificate (it'll return false).

Simply destroy the client connection if the certificate was not from CloudFlare or no certificate was presented at all.

const https = require('https')
const verify = require('cloudflare-origin-pull').verify

  pfx: 'my-cert.p12',
  requestCert: true,
  rejectUnauthorized: false
}, (req, res) => {
  if (!verify(req.client.getPeerCertificate())) {

  res.end('You’re cool.')