Next-generation Global CDN
Upgrade to Next-generation GCDN with bot protection
Learn how to migrate from Pantheon's Legacy Global CDN to our Next-generation Global CDN.
Setup
The next-generation GCDN is becoming compatible with Advanced Global CDN (AGCDN) sites in waves. If your site uses AGCDN, do not start the upgrade from the dashboard or with terminus gcdn:upgrade until Pantheon Support or your Account Team confirms your site is compatible. Starting the upgrade automatically moves your site's platform hostnames (*.pantheonsite.io) to the next-generation GCDN.
If you've already started the upgrade on an AGCDN site, do not change your DNS records. Contact Pantheon Support for next steps.
For the best experience, be prepared to update your DNS records as soon as possible after starting the migration. Delaying DNS migration can result in inconsistent behavior, as your site will remain on the old CDN infrastructure until DNS is pointed to the new GCDN.
Custom domains that use a CNAME record in their DNS settings that point to a Pantheon platform hostname (for example, live-yoursite.pantheonsite.io) are not supported by the next-generation GCDN and will not be supported going forward. Sites configured this way will experience interruptions when migrated.
Before activating the next-generation GCDN, check your custom domain's DNS configuration. It must resolve via A/AAAA records as shown on the site's Domains page, not via a CNAME pointed at a *.pantheonsite.io hostname. If the Domains page shows Remove this detected record next to a CNAME, remove it from your DNS provider. See Custom Domains for details.
If your custom domain currently points at a platform hostname via CNAME, contact Pantheon Support before requesting migration.
Using Cloudflare in Front of Pantheon (Orange-to-Orange)
If your domain is already proxied through your own Cloudflare zone (orange-clouded), the next-generation GCDN supports Cloudflare's Orange-to-Orange (O2O) configuration, which keeps your Cloudflare zone in front of Pantheon's GCDN. See Migrate a Cloudflare-Proxied Domain (O2O) for the full walkthrough.
Using a Third-Party CDN in Front of Pantheon
You can place a third-party CDN or reverse proxy in front of the next-generation GCDN, with one hard requirement: on every request it sends to Pantheon, the fronting service must present a TLS Server Name Indication (SNI) value that matches the HTTP Host header.
The next-generation GCDN routes and validates custom domains using the SNI value in the TLS handshake. Requests whose SNI does not match the Host header are rejected at the edge with a 403 response before they reach your site. This is intentional security behavior that prevents domain fronting, and it cannot be disabled for individual domains.
When configuring your CDN, for each custom domain:
- Add the domain to your Pantheon environment and complete domain verification so a certificate is provisioned.
- Set the CDN's origin address to the GCDN edge hostname shown in your dashboard DNS values (the
fe.CNAME target). - Set both the origin
Hostheader and the outbound TLS SNI to the custom domain itself (for example,www.example.com), not thefe.edge hostname.
If your CDN cannot set the outbound SNI independently of the configured origin hostname, it cannot be used in front of the next-generation GCDN. Azure Front Door currently has this limitation (see Known Limitations).
If the service in front of Pantheon is your own Cloudflare zone, use the Orange-to-Orange configuration instead.
