Skip to main content
The Origin agent needs outbound access to three Origin-hosted endpoints over standard HTTPS on TCP port 443. Each agent connects only to the endpoints for the region it was installed into. Verify that all three are reachable before you deploy the agent. If the registration endpoint is unreachable, installation fails. If an endpoint is blocked later, the agent stops sending telemetry or stops updating.

​
Required endpoints

Web proxy or SASE gateway in the path? We recommend allowing all three hostnames for your region on TCP 443 and excluding them from TLS/SSL inspection. The agent validates the certificate it receives, so a gateway that re-signs the connection can cause registration, updates, and heartbeat to fail even when the TCP port is open. We also recommend allowlisting the full hostnames rather than specific URLs, because download and upload links on the CDN are signed, short-lived, and different each time.

​
Verifying connectivity

Run these checks on the target endpoint before installation. A successful TCP connection on port 443 is the main signal you’re looking for. These endpoints serve the agent rather than a web page, so a browser that gets an HTTP error back is expected and doesn’t mean the check failed. The examples below use the United States hostnames. For Australia, replace prod with aus in each hostname.
Run the following in an elevated PowerShell session. The commands confirm that the endpoint can open a TCP connection to each Origin host on port 443.
Expected output: For each command, TcpTestSucceeded should report True. A populated RemoteAddress also confirms that the hostname resolved in DNS.
To also confirm that the TLS handshake completes end to end, which is useful when a proxy sits in the path, run:
A clean handshake shows the connection being established and the TLS certificate being presented without error.

​
If connectivity is unavailable

Installation runs in two phases. The first phase copies files and registers the agent’s service or daemon, and doesn’t need network access. The second phase registers the agent with the backend through the registration endpoint for your region, and does need network access. If that endpoint is unreachable, the install fails.

​
What the failure looks like

  • Windows: The MSI’s final registration step runs during InstallFinalize. If it can’t reach the registration endpoint, it returns a non-zero result and the installer reports a failed installation. Under Intune, this shows up as a failed app installation.
  • macOS: The .pkg postinstall script performs registration. If the endpoint is unreachable, the postinstall step fails and the package install reports failure.
In both cases the agent never receives its client certificate, so it can’t authenticate to Origin even after connectivity is restored. Re-run the installer once the endpoint is reachable.

​
If registration succeeds but an endpoint is blocked later

Sometimes the registration endpoint is reachable at install time, but the endpoint host for your region is blocked afterward, for example by a later firewall or proxy change. The agent stays installed and registered, but it can’t send heartbeats, retrieve configuration, or report AI activity. In the Origin console, the endpoint shows a stale or missing last seen time and reports no telemetry. If the agent-cdn host for your region is blocked later, the agent keeps running but can’t download updates or upload diagnostic logs.
To avoid these failure modes, use the checks above to confirm that all three endpoints for your region are reachable before you deploy the agent at scale.