CloudFlare 推出的 Origin CA 用來保護從 CloudFlare 到 Origin Server 這段的過程：「Introducing CloudFlare Origin CA」，也就是右半部這段：
CloudFlare 把這個新功能包裝得很神，但實際上只是弄個 CA 出來跑而已，僅此而已。
當然，由於他不需要處理 Public CA 的問題，所以有很多在一般 TLS 連線需要做的檢查步驟可以被簡化，藉此達到效能改善，包括了省掉 intermediate certificates、OCSP 以及 SCTs：
With Origin CA certificates, we’ve stripped everything that’s extraneous to communication between our servers and yours to produce the smallest possible certificate and handshake. For example, we have no need to bundle intermediate certificates to assist browsers in building paths to trusted roots; no need to include signed certificate timestamps (SCTs) for purposes of certificate transparency and EV treatment; no need to include links to Certification Practice Statements or other URLs; and no need to listen to Online Certificate Status Protocol (OCSP) responses from third-parties.
進而省下大量的連線成本：
Eliminating these unnecessary components typically found in certificates from public CAs has allowed us to reduce the size of the handshake by up to 70%, from over 4500 bytes in some cases to under 1300.