FAQ about origin fetch

502 error with an HTTPS origin

1. Check that the domain name resolves correctly.

2. Check if the origin server is accessible.

3. Check that the origin server supports HTTPS access.

4. If the origin server's IP address hosts multiple domain names, configure default origin SNI to specify the requested domain name. This prompts the server to return the correct SSL certificate based on the SNI, ensuring a successful origin fetch.

Common Name verification

During an origin fetch, CDN verifies that the SNI in the origin fetch request matches the Common Name of the certificate from the origin server. The origin fetch succeeds only if they match.

If you do not modify the origin SNI, the Host header in the origin fetch request defaults to the accelerated domain name. In this case, CDN verifies the Common Name of the certificate for the accelerated domain name.

Custom port for an HTTPS origin

1. Log on to the CDN console.

2. In the left navigation pane, click Domain Names.

3. On the Domain Names page, find the target domain name and click Manage in the Actions column.

4. In the domain's navigation pane, click Origin Fetch.

5. In the Origin Protocol Policy section, turn on the Origin Protocol Policy switch.

6. Click Modify.

7. Configure the custom port.

CDNOrigin fetch protocol when HTTPS is enabled

Configuring an HTTPS certificate in CDN is independent of the origin protocol. By default, the origin fetch protocol depends on the port that you set when you configure an origin server:

• If the origin port is 443, the origin fetch uses HTTPS.

• If the origin port is 80 or another port, the origin fetch uses HTTP.

If you need to specify the origin protocol, you can configure the origin protocol.

Resolve the You have no right to access this object because of bucket acl. error

An OSS bucket is configured as private to provide access control and prevent unauthorized traffic theft. In this case, you must enable the OSS Private Bucket Origin Fetch feature for the accelerated domain name. This resolves the error and allows CDN to accelerate resources in the private OSS bucket.

Resolve the This request is forbidden by kms. error

If you use Key Management Service (KMS) to encrypt objects in your OSS bucket, you must grant the CDN origin fetch role permission to use the KMS key. Without this permission, CDN cannot decrypt and access the files, which causes the This request is forbidden by kms. error.

1. Log on to the RAM console.

2. In the left-side navigation pane, choose .

3. In the Role Name list, find and click the AliyunCDNAccessingPrivateOSSRole role.

4. Click Add Authorization. The Principal is automatically populated.

5. Under Policies, select System Policies, search for and click AliyunKMSCryptoUserAccess to add it to the Selected Policies box.

6. Click Confirm New Authorization. A message indicates that the operation is Completed.

7. Click Disable.

8. Use the refresh and prefetch feature to clear the cache. After the refresh task is complete, try to access the resource again.

Use STS for cross-account origin fetch

By default, CDN uses a Security Token Service (STS) token to access a private bucket only if the bucket belongs to the same account. To enable cross-account origin fetch to a private OSS bucket by using an STS token, you can add a Bucket Policy in OSS. The following steps describe how to configure the policy:

1. Log on to the Alibaba Cloud account that owns the private bucket and go to the OSS console.

2. Click Buckets, find the target bucket, click the Permission Control tab, click the Bucket Policy tab, and then click Authorize.

   

3. For Authorized User, select Other Accounts and enter arn:sts:uid. Replace uid with the ID of the account where CDN is activated. For Authorized Operation, select Simple Settings > Read-Only (excluding ListObject). Then, click OK.

   

4. After the policy is added, you can view the authorization details on the Bucket Policy tab.

   

Troubleshoot origin fetch failures after CNAME configuration

After adding a CNAME record for your accelerated domain name, an origin fetch may fail. This issue is typically caused by DNS resolution issues, origin server misconfigurations, or incorrect origin fetch settings in CDN. You can perform the following steps to troubleshoot the issue:

1. Verify that the CNAME record has taken effect

   Run the ping <accelerated_domain_name> or nslookup <accelerated_domain_name> command. If the output contains .*.kunlun*.com, the CNAME record is in effect. If the domain name still resolves to the IP address of the origin server or fails to resolve, check your DNS record configuration.

2. Check the CNAME record type and for conflicts

   The record type must be CNAME. If you set it to another type, resolution fails. A CNAME record cannot coexist with other record types for the same host. You must delete any conflicting records and then add the CNAME record again.

3. Verify origin server reachability

   Run the curl -I http://<origin_server_IP_or_domain> command to check whether your origin server is responding correctly. Make sure that your origin server is running and accessible from the internet.

4. Check the IP allowlist on the origin server

   CDN points of presence use specific IP address ranges for origin fetch. If your origin server has an IP allowlist or firewall rules configured, you must add the CDN IP address ranges to the allowlist. Otherwise, the origin server rejects origin fetch requests from CDN.

5. Check the origin protocol and port configuration

   Verify that the origin protocol (HTTP or HTTPS) configured in CDN matches your origin server's supported protocol. Also, make sure the origin port matches your origin server's listening port. If your origin server uses HTTPS on a non-standard port, you must configure a custom origin port in CDN.