In the future we plan to allow for more granular origin certificate validation. For example, if you are CNAME'ing www.example.com to example.anotherprovider.co

In the future we plan to allow for more granular origin certificate validation. For example, if you are CNAME'ing www.example.com to example.anotherprovider.com, you /may/ be fine with us checking that the origin certificate has a SAN matching that destination, *.anotherprovider.com, or a hostname that you specify.