From 0d0c44872502439057c24bc1199be0ac711b1128 Mon Sep 17 00:00:00 2001 From: Orkun Date: Fri, 20 Mar 2026 10:31:20 +0300 Subject: [PATCH 1/3] fix: supernet error due to ssl mismatch This commit fixes Akamai's SUPERNET error causing by SSL Mismatch between Origin IP and Root CA --- assets/rulesTemplate.json | 39 +++++++++++++++++++++++++++++++++------ 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/assets/rulesTemplate.json b/assets/rulesTemplate.json index fff1be5..065cc3d 100644 --- a/assets/rulesTemplate.json +++ b/assets/rulesTemplate.json @@ -145,7 +145,7 @@ "cacheKeyHostname": "ORIGIN_HOSTNAME", "compress": true, "enableTrueClientIp": false, - "verificationMode": "THIRD_PARTY", + "verificationMode": "CUSTOM", "originSni": true, "httpPort": 80, "httpsPort": 443, @@ -153,7 +153,16 @@ "originCertificate": "", "ports": "", "ipVersion": "DUALSTACK", - "minTlsVersion": "DYNAMIC" + "minTlsVersion": "DYNAMIC", + "customValidCnValues": [ + "{{Origin Hostname}}", + "{{Forward Host Header}}" + ], + "originCertsToHonor": "STANDARD_CERTIFICATE_AUTHORITIES", + "standardCertificateAuthorities": [ + "akamai-permissive", + "THIRD_PARTY_AMAZON" + ] } }, { @@ -339,7 +348,7 @@ "cacheKeyHostname": "ORIGIN_HOSTNAME", "compress": true, "enableTrueClientIp": true, - "verificationMode": "THIRD_PARTY", + "verificationMode": "CUSTOM", "originSni": true, "httpPort": 80, "httpsPort": 443, @@ -349,7 +358,16 @@ "ipVersion": "DUALSTACK", "trueClientIpHeader": "FPJS-Proxy-Client-IP", "trueClientIpClientSetting": false, - "minTlsVersion": "DYNAMIC" + "minTlsVersion": "DYNAMIC", + "customValidCnValues": [ + "{{Origin Hostname}}", + "{{Forward Host Header}}" + ], + "originCertsToHonor": "STANDARD_CERTIFICATE_AUTHORITIES", + "standardCertificateAuthorities": [ + "akamai-permissive", + "THIRD_PARTY_AMAZON" + ] } }, { @@ -415,7 +433,7 @@ "cacheKeyHostname": "ORIGIN_HOSTNAME", "compress": true, "enableTrueClientIp": false, - "verificationMode": "THIRD_PARTY", + "verificationMode": "CUSTOM", "originSni": true, "httpPort": 80, "httpsPort": 443, @@ -423,7 +441,16 @@ "originCertificate": "", "ports": "", "minTlsVersion": "DYNAMIC", - "ipVersion": "DUALSTACK" + "ipVersion": "DUALSTACK", + "customValidCnValues": [ + "{{Origin Hostname}}", + "{{Forward Host Header}}" + ], + "originCertsToHonor": "STANDARD_CERTIFICATE_AUTHORITIES", + "standardCertificateAuthorities": [ + "akamai-permissive", + "THIRD_PARTY_AMAZON" + ] } }, { From 03a68ef0b9ea65a375d9a5fb795aab4d98e85c07 Mon Sep 17 00:00:00 2001 From: Orkun Date: Fri, 20 Mar 2026 10:44:47 +0300 Subject: [PATCH 2/3] ci: fix default rule origin --- scripts/deployRules.ts | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/scripts/deployRules.ts b/scripts/deployRules.ts index 9676e06..5eb70b3 100644 --- a/scripts/deployRules.ts +++ b/scripts/deployRules.ts @@ -32,6 +32,43 @@ const createNewVersion = async (propertyId: string) => { return getLatestVersion(propertyId) } +const patchDefaultRuleOrigin = async (propertyId: string, version: string) => + akamaiRequest({ + path: `/papi/v1/properties/${propertyId}/versions/${version}/rules?contractId=${process.env.AK_CONTRACT_ID}&groupId=${process.env.AK_GROUP_ID}`, + method: 'PATCH', + headers: { + 'Content-Type': 'application/json-patch+json', + }, + body: JSON.stringify([ + { + op: 'replace', + path: '/rules/children/0/behaviors/0/options/customValidCnValues', + value: [ + "{{Forward Host Header}}", + "{{Origin Hostname}}" + ] + }, + { + op: 'replace', + path: '/rules/children/0/behaviors/0/options/verificationMode', + value: "CUSTOM" + }, + { + op: 'replace', + path: '/rules/children/0/behaviors/0/options/originCertsToHonor', + value: "STANDARD_CERTIFICATE_AUTHORITIES" + }, + { + op: 'replace', + path: '/rules/children/0/behaviors/0/options/standardCertificateAuthorities', + value: [ + "THIRD_PARTY_AMAZON", + "akamai-permissive" + ] + } + ]) + }) + const patchOriginHostname = async (propertyId: string, version: string) => akamaiRequest({ path: `/papi/v1/properties/${propertyId}/versions/${version}/rules?contractId=${process.env.AK_CONTRACT_ID}&groupId=${process.env.AK_GROUP_ID}`, @@ -130,6 +167,7 @@ import('../dist/patch-body/body.json').then((module) => { } catch (_) { // Ignore error if fingerprint rules not exists } + await patchDefaultRuleOrigin(propertyId, propertyVersion) await patchAddFingerprintRules(propertyId, propertyVersion, JSON.stringify(patchReqBody)) await activateVersion(propertyId, propertyVersion) } catch (e: any) { From 4c351b16c2e3a725160279b72b356c1554a32237 Mon Sep 17 00:00:00 2001 From: Orkun Date: Fri, 20 Mar 2026 11:02:42 +0300 Subject: [PATCH 3/3] ci: change default rule origin path --- scripts/deployRules.ts | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/deployRules.ts b/scripts/deployRules.ts index 5eb70b3..54d7966 100644 --- a/scripts/deployRules.ts +++ b/scripts/deployRules.ts @@ -42,7 +42,7 @@ const patchDefaultRuleOrigin = async (propertyId: string, version: string) => body: JSON.stringify([ { op: 'replace', - path: '/rules/children/0/behaviors/0/options/customValidCnValues', + path: '/rules/behaviors/0/options/customValidCnValues', value: [ "{{Forward Host Header}}", "{{Origin Hostname}}" @@ -50,17 +50,17 @@ const patchDefaultRuleOrigin = async (propertyId: string, version: string) => }, { op: 'replace', - path: '/rules/children/0/behaviors/0/options/verificationMode', + path: '/rules/behaviors/0/options/verificationMode', value: "CUSTOM" }, { op: 'replace', - path: '/rules/children/0/behaviors/0/options/originCertsToHonor', + path: '/rules/behaviors/0/options/originCertsToHonor', value: "STANDARD_CERTIFICATE_AUTHORITIES" }, { op: 'replace', - path: '/rules/children/0/behaviors/0/options/standardCertificateAuthorities', + path: '/rules/behaviors/0/options/standardCertificateAuthorities', value: [ "THIRD_PARTY_AMAZON", "akamai-permissive"