CDN unable to access assets from origin

No, they have to originate from the web server, just run a second cdn for the web.