An origin server is a physical location that stores your deliverable content and responds to requests from Akamai edge servers. This is the second stage of the request flow, where edge servers retrieve content from your origin.

You provision and maintain your origin outside Akamai. Complete the prerequisites in this topic before you create a workspace in Delivery Manager. Delivery Manager prompts you for an origin hostname during workspace creation, and you can't route traffic to the edge network until a reachable origin is configured.

🚧

Two of these prerequisites depend on systems outside Akamai and can't be completed on demand: publishing a DNS record for your origin hostname, and obtaining a certificate for that hostname. Begin both before you configure delivery.

Choose an origin type

The type of content you deliver determines the origin type you can use. Each type has a different set of prerequisites.

NetStorage and Akamai Object Storage must be enabled on your contract. Contact your account team to confirm availability before you select either type.

Set your origin hostname

Your origin hostname is the name edge servers resolve to locate your content. It's different form the service hostname your end users request.

Create a dedicated origin hostname

End users currently reach your origin through your primary domain. For example, www.example.com resolves to an A record that points to your origin's IP address.

After you point your traffic to Akamai, www.example.com becomes a CNAME record that points to your assigned edge hostname, so that Akamai DNS can return the IP address of the nearest edge server. See How content delivery works.

❗️

Don't reuse an existing DNS record

If your site is live and www.example.com points to your origin, don't enter www.example.com as the origin hostname in Delivery Manager. At cutover, that name would become a CNAME to your edge hostname and could no longer carry the A record that edge servers require. This would lead to edge servers resolving the origin hostname, receiving the edge hostname in response, and requesting content from themselves.

Create a separate hostname for your origin and publish it before pointing traffic to Akamai.

Each service hostname you serve through Akamai requires an origin hostname that is distinct from it. Multiple service hostnames can share a single origin hostname.

Define the origin hostname

Origin hostnames typically use the formula {origin}-{content origin}, where the following apply:

• {origin} is the origin A record. As a best practice, use a random string, for example 1hkeh1g76. This conceals your origin server.
• {content origin} is the service hostname your end users currently use.

👍

Once established, make note of this value. You enter it in Delivery Manager when you create a workspace.

Best practices and limitations

• Don't use the IP address as an origin hostname. Your origin server has a unique IP address, but Akamai strongly advises against using an address rather than a hostname defined in public DNS. As any address change or reassignment might make your origin unreachable and result in a denial of service.
• Review disallowed origin IP addresses. Your origin hostname must resolve to an externally routable IP address through a public DNS server. Don't use internal non-routable ranges, either directly or as the resolved IP address of your hostname. Akamai can't connect to any IP address within these ranges, as they're reserved for internal network use:
• 10.0.0.0 – 10.255.255.255
• 172.16.0.0 – 172.31.255.255
• 192.168.0.0 – 192.168.255.255

Configure the DNS record

Create the DNS record for your origin hostname on your authoritative name servers, using the same method you'd use for any other DNS record. The IP address must be exactly the same as the IP address in the DNS record for your production hostname before you switch to the edge network.

Both records coexist until you point traffic to Akamai. The original name continues to serve your end users, and the new name gives edge servers a stable route to the same origin after the original name becomes a CNAME.

Before you configure delivery, verify that:

• The origin hostname resolves from outside your network. Use a command-line DNS tool such as dig or nslookup, or an external DNS lookup service.
• Your origin returns content when requested using the origin hostname. If your origin is a virtual host that responds only to www.example.com, either add the origin hostname to its configuration or forward the incoming host header instead. See Configure origin settings.

Create an origin certificate

An origin certificate secures the connection between Akamai edge servers and your origin, the second phase of the request flow. It's distinct from your edge certificate, which secures the connection between end users and edge servers. Delivery Manager provisions and renews edge certificates. Origin certificates are required for custom and third-party origins, and you obtain, install, and rotate them yourself.

📘

Non-secure HTTP origins

If edge servers connect to your origin over HTTP, you don't need an origin certificate. Akamai supports non-secure HTTP connections, but this isn't recommended because HTTPS is now the industry norm.

The certificate must be valid for the origin hostname you created, not only for your primary domain. A certificate issued solely for www.example.com fails verification against 1hkeh1g76-www.example.com. Either include the origin hostname in the certificate's subject alternative name (SAN) list, or forward the incoming host header and verify against that name instead.

There are three ways to set up and install this certificate. Select an approach before you request the certificate, because each one determines what you request from your certificate authority.

Use a publicly trusted certificate authority

Akamai uses Let's Encrypt as the default certificate authority. Review the Let's Encrypt guidelines for setting up certificates on your origin server.

You can also install a certificate obtained from another trusted certificate authority. Edge servers trust certificates signed by any certificate authority listed in the Akamai Certificate Store. For installation instructions, see the DigiCert documentation for Apache or Nginx.

Use a custom certificate authority

You can specify which certificate authorities Akamai trusts for your site, including a certificate authority you set up yourself.

1. Provision an origin certificate using a custom certificate authority. To sign the certificate yourself, use a tool such as the openssl tool or the CA.pl interface.
2. Install the certificate on your origin server, in the same way you'd install a certificate from any other certificate authority.

Pin an exact certificate

You can specify the exact certificate that Akamai trusts for your origin, including a self-signed certificate. This is known as pinning. Edge servers check that the origin sent the specified certificate, then skip the remaining checks, including the signature, the SAN list, and the expiration date.

Generate the certificate using either method:

Apply the verification setting

After you add your origin, you pair your certificate approach with an origin SSL certificate verification setting. Choose your own certificate is recommended, as it gives you direct control over which certificates edge servers trust. For the full list of settings, see Configure origin settings.

Rotate your origin certificate

Depending on how you created and applied your origin certificate, you may need to rotate to a new one.

Origins in Delivery Manager are workspace-level components. When you add an origin to your workspace, it's available to all environments within that workspace, so a certificate change affects every environment that uses it. Activate the change on the staging network and test it before you activate on production. See Test on staging.

For a certificate issued by a publicly trusted or custom certificate authority, rotate the certificate on your origin before it expires. Confirm that the new certificate is signed by a trusted certificate authority and is valid for the same hostnames. No change in Delivery Manager is required.

For a pinned certificate, start the rotation before the certificate expires and complete the steps in this order:

1. Add the new certificate to your origin settings in Delivery Manager, alongside the existing one.
2. Activate the change on the production network.
3. Switch your origin server to the new certificate.
4. Once traffic is stable, remove the old certificate and activate the change again.

🚧

Complete a pinned certificate rotation in this order. Otherwise, edge servers won't trust the certificate your origin sends and may cause a service outage.

Prepare your origin for edge server traffic

After you go live, every request your origin receives arrives from an edge server rather than directly from an end user. Complete these tasks before cutover.

• Firewall access: Allow Akamai edge server IP addresses through your firewall. Edge servers connect from a large and changing range of addresses.
• Client IP headers: Update anything that reads the client IP address, such as allow lists, rate limits, geo logic, bot rules, and access logs, to read the True-Client-IP header instead of the connecting address. See Configure origin settings.
• Connection ports: By default, edge servers connect on port 80 for HTTP and port 443 for HTTPS. If your origin listens on different ports, make note of them.
• Host header: Determine which hostname your origin expects in the Host request header. Delivery Manager can forward the incoming host header, the origin hostname, or a custom value, and your origin's virtual host configuration must match your selection.
• Access control: Configure your origin to accept requests only from Akamai edge servers. See access control list solutions.

📘

Firewall access and client IP handling also appear as prerequisites in Point traffic to Akamai. Complete them during origin preparation, as unresolved origin access issues block cutover.

Prepare a third-party origin

A third-party origin uses external cloud storage, such as Amazon Web Services or Interoperability Google Cloud Storage. Set up the storage with your provider and upload your content, then collect the following:

• Origin hostname. Your provider assigns your storage a unique name on its network. This full value is your origin hostname.
• Authentication credentials. Required only if you don't use Cloud Access Manager:
  • Amazon Web Services. Access Key ID, Secret Access Key, region, and endpoint service. The endpoint service is the service code preceding amazonaws.com, commonly s3.
  • Interoperability Google Cloud Storage. Access ID and Secret.

Akamai recommends Cloud Access Manager instead of storing credentials in your configuration. Cloud Access Manager keeps your keys private, and edge servers inject authentication on the forward path. If you use it, create an access key first and make note of its name. You select the key by name when you add an origin.

Match the security level of your origin connection to the security level you selected for your edge certificate.

Prepare NetStorage

NetStorage is native to the Akamai network and is always secure, so no origin certificate is required. Before you configure delivery:

1. Create a storage group.
2. Create an upload account to access the storage group.
3. Upload your content using SFTP, SecureCopy, rsync, or Aspera.

Make note of your storage group name and the CP code assigned to the upload directory. You need both values to configure your origin.

Collect your origin details

Before you create a workspace, confirm that you have the following.

Next steps

Once your origin is prepared, configure delivery. See Quickstart, or Add an origin if your workspace already exists.