Hi @Nitesh-Chavan ,
1. Use curl with --resolve to Bypass the CDN
This method tricks curl into bypassing the CDN and directly hitting your origin server while preserving the correct Host header (which is key for TLS SNI-based certs).
Command:
curl -v https://yourdomain.com --resolve yourdomain.com:443:ORIGIN_IP
Example:
curl -v https://www.example.com --resolve www.example.com:443:192.0.2.10
This forces the request to go directly to the origin server at 192.0.2.10, but with the domain still set to www.example.com, so the SSL certificate returned is from the origin.
What to Look For:
Check the output lines:
* SSL certificate verify ok.
* subject: CN=origin.example.com
* start date: May 10 00:00:00 2025 GMT
* expire date: Aug 10 23:59:59 2025 GMT
* issuer: C=US; O=Let's Encrypt; CN=R3
This method works even behind Akamai or Cloudflare, as long as you know the origin IP (can be dispatcher, ELB, or publisher).
2. Use openssl s_client with SNI and IP
You can also verify using OpenSSL to directly connect to the origin:
openssl s_client -connect ORIGIN_IP:443 -servername yourdomain.com
Example:
openssl s_client -connect 192.0.2.10:443 -servername www.example.com
Look for:
subject=CN=... and issuer=... in the certificate section
Verify return code: 0 (ok) for successful verification
Regards,
Amit
