Edge Acceleration

Site Acceleration
- Overview
- Access Control
  - Token authentication
    - Token Authentication
    - Authentication Method A
    - Authentication Method B
    - Authentication Method C
    - Authentication Method D
    - Authentication Method V
- Smart Acceleration
- Cache configuration
  - Overview
  - EdgeOne caching rules introduction
    - Content Cache Rules
    - Cache Key Introduction
    - Vary Feature
  - Cache Configuration
    - Custom Cache Key
    - Node Cache TTL
    - Status Code Cache TTL
    - Browser Cache TTL
    - Offline Caching
    - Cache Prefresh
  - Clear and Preheat Cach
    - Cache Purge
    - URL Pre-Warming
    - Prefetch M3U8
  - How to improve the Cache Hit Rate of EdgeOne
- File Optimization
  - Content Compression
  - Smart Compression
- Network Optimization
  - HTTP/2
  - HTTP/3(QUIC)
    - Overview
    - Enable HTTP/3
    - QUIC SDK
      - SDK Overview
      - SDK Download and Integration
      - Sample Code
        Android
        iOS
      - API Documentation
        Android
        iOS
  - IPv6 Access
  - Maximum Upload Size
  - WebSocket
  - Client IP Geolocation Header
  - Client IP Geographical Location
  - gRPC
  - Network Error Logging
- URL Rewrite
  - Access URL Redirection
  - Origin-Pull URL Rewrite
- Modifying Header
  - Modifying HTTP Response Headers
  - Modifying HTTP Request Headers
- Modify response content
  - HTTP Response
  - Custom Error Page
- Rules Engine
  - Overview
  - Rule Management
  - variables
  - Supported Matching Types and Actions
- Image and video processing
  - Audio and Video Pre-pulling
  - Just-in-Time Image Processing
  - Video Just-In-Time Processing
  - VOD Media Origin
- Speed limit for single connection download
- Request and Response Actions
  - HTTP Response
  - Processing order
  - Default HTTP Headers of Origin-Pull Requests
  - Default HTTP Response Headers
  - HTTP Restrictions
- Media Services
  - Audio and Video Pre-pulling
  - Just-in-Time Image Processing
  - Just-in-Time Media Processing
  - VOD Media Origin
L4 Proxy
- Overview
- Creating an L4 Proxy Instance
- Modifying an L4 Proxy Instance
- Disabling or Deleting an L4 Proxy Instance
- Batch Configuring Forwarding Rules
- Obtaining Real Client IPs
  - Obtaining Real TCP Client IPs via TOA
  - Obtaining Real Client IPs Through Protocol V1/V2
    - Overview
    - Method 1: Obtaining Real Client IPs Through Nginx
    - Method 2: Parsing Real Client IPs on Application Server
    - Format of Real Client IPs Obtained Through Proxy Protocol V1/V2
  - Transmitting Client Real IP via SPP Protocol
Domain name service and origin server configuration
- Domain Name Services
  - Overview
  - DNS resolution for managed domains
    - Modifying DNS Servers
    - Configuring DNS Records
    - Batch Importing DNS Records
    - Advanced DNS Configuration
  - Access accelerated domains
    - Adding A Domain Name for Acceleration
    - Ownership Verification
    - Modifying CNAME Records
    - Verify Business Access
  - Traffic scheduling
    - Traffic Scheduling Management
- HTTPS Certificate
  - Overview
  - Edge HTTPS Certificate
    - Overview
    - Deploying/Updating SSL Certificate for A Domain Name
    - Configuring A Free Certificate for A Domain Name
    - Using Keyless Certificate
  - Edge mTLS Authentication
  - Origin Certificate Validation
  - HTTPS configuration
    - Forced HTTPS Access
    - Enabling HSTS
    - SSL/TLS security configuration
      - Configuring SSL/TLS Security
      - TLS Versions and Cipher Suites
    - Enabling OCSP Stapling
  - Related References
    - Using OpenSSL to Generate Self-Signed Certificates
    - Certificate Format Requirements
    - The Difference Between one-way authentication and Mutual authentication
- Origin Configuration
  - Load Balancing
    - Overview
    - Quickly Create Load Balancers
    - Health Check Policies
    - Viewing the Health Status of Origin Server
    - Related References
      - Load Balancing-Related Concepts
      - Introduction to Request Retry Strategy
  - Origin Group Configuration
  - Origin configuration
    - Origin-Pull Timeout
    - Configuring Origin-Pull HTTPS
    - Host Header Rewrite
    - Controlling Origin-pull Requests
    - Redirect Following During Origin-Pull
    - HTTP/2 Origin-Pull
    - Range GETs
    - Modify Origin
    - Origin-pull Rate Limiting Policy
  - Origin Protection(Obtaining/Updating Origin IP Address Range)
  - Related References
    - ld Version Origin Group Compatible Related Issues

Origin Certificate Validation

When a request is back to the origin server via an EdgeOne edge node, if the origin-pull traffic uses the HTTPS protocol, EdgeOne does not perform legitimacy verification on the origin certificate validity by default. If you currently have higher security requirements for this handshake, EdgeOne can be configured to perform origin certificate verification. This allows custom validation methods to verify the origin certificate legitimacy, preventing malicious attacks such as origin-pull traffic hijack.
Note:
Only plan of Basic Edition or above support using this feature.
Supported Verification Methods
Verification Method
Verification Content
No verification
No verification of the origin server response cert legitimacy.
Verify with Specified Trusted CA Certificate
Verify whether the origin certificate is issued by the CA and check its validity period. If the origin certificate is not issued by the CA or is not within the valid period, the handshake fails with a 525/555 response.
Operation Steps
Scenario: Verify origin certificate with specified trusted CA certificate
For example: The origin server for the current domain example.com uses certificates issued by a certain CA. To avoid hijacking of origin-pull traffic, only origin certificates issued by this CA are trusted.
1. Log in to the Tencent Cloud EdgeOne console, select the configured site from the site list, and enter the site management secondary menu.
2. In the left sidebar, click DNS > Domain Management. On the domain management page, select the domain name to configure the certificate, then click Edit in the HTTPS column to pop up the certificate configuration.
3. Find the Origin Certificate Validation card and click Configure. Select the verification method as Verify with Specified Trusted CA Certificate, then check the trusted CA certificate.
Note:
Upload trusted CA certificates to Tencent Cloud SSL console. For certificate format requirements, see Certificate Format Requirements.
﻿
﻿
﻿
4. Click Save to issue the configuration. The configuration will take effect after deployment.
5. Directly use the curl command to trigger an access test and check whether the request responds normally. If the request response is normal and the response header EO-Cache-Status is MISS or RefreshHit, it signifies the current request has returned to the origin normally. If the origin server's configured certificate is not issued by the CA, the back-to-origin handshake fails, and you can see a 525/555 status code.
curl https://www.example.com/ -v

Supported Verification Methods
Operation Steps
- Scenario: Verify origin certificate with specified trusted CA certificate

Verification Method	Verification Content
No verification	No verification of the origin server response cert legitimacy.
Verify with Specified Trusted CA Certificate	Verify whether the origin certificate is issued by the CA and check its validity period. If the origin certificate is not issued by the CA or is not within the valid period, the handshake fails with a 525/555 response.