INTER-1895 Fix SSL Mismatch - #79
Merged
Merged
Conversation
This commit fixes Akamai's SUPERNET error causing by SSL Mismatch between Origin IP and Root CA
Contributor
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Akamai origin TLS certificate verification to use custom validation (explicit CNs + trusted CA sets) to address SSL mismatch scenarios, and adds a deployment-time patch to apply these settings to the property default rule.
Changes:
- Switch
verificationModetoCUSTOMand addcustomValidCnValues,originCertsToHonor, andstandardCertificateAuthoritiesto multiple origin behaviors in the rules template. - Add
patchDefaultRuleOriginin the deployment script to patch the property’s default rule origin settings during deployment. - Update the deployment flow to apply the default-rule patch before adding fingerprint rules and activating.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| scripts/deployRules.ts | Adds a JSON Patch step to modify default-rule origin certificate validation and remove a behavior during deployment. |
| assets/rulesTemplate.json | Updates origin behaviors to use CUSTOM cert verification and explicit CN/CA allowlists. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
necipallef
approved these changes
Mar 25, 2026
|
🎉 This PR is included in version 1.0.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces significant enhancements to the Akamai property rules configuration by switching origin certificate verification to a custom mode and specifying which certificate authorities and common name values should be honored. Additionally, a new script function is added to automate patching these settings during deployment. These changes improve security and flexibility in certificate validation for origin connections.
Akamai property rules configuration updates:
verificationModefrom"THIRD_PARTY"to"CUSTOM"in multiple origin rules, enabling custom certificate validation logic. [1] [2] [3]customValidCnValues,originCertsToHonor, andstandardCertificateAuthoritiesoptions to origin rules, specifying which common names and certificate authorities are considered valid. [1] [2] [3]Deployment script enhancements:
patchDefaultRuleOriginfunction inscripts/deployRules.tsto automate patching the default rule with custom certificate validation settings, including removing an unnecessary behavior.patchDefaultRuleOriginbefore adding fingerprint rules and activating the version, ensuring the new settings are applied during deployment.