The thing people get wrong about 525
Cloudflare sits between your visitor and your real server. A visitor connects to Cloudflare, and Cloudflare connects to your origin.
That is two separate secure connections, not one. Error 525 is Cloudflare telling you the second one failed.
So the error page has Cloudflare branding, but Cloudflare is not broken. It is reporting that it could not talk to your server. People spend hours in the Cloudflare dashboard when the problem is on the machine behind it.
Error 525: SSL handshake failedThe handshake is the opening negotiation of a secure connection. In a 525 it never completes, so no page is ever requested from your server.
What Cloudflare documents as the causes
This error only appears when your SSL/TLS mode is Full or Full (strict), because those are the modes where Cloudflare insists on encrypting the connection to your origin. The documented causes are:
- →No valid SSL certificate installed at the origin. The most common one. Your server has nothing to present, or nothing usable.
- →Port 443 is not open on the origin, or the custom secure port you configured is not open. Cloudflare knocks and nothing answers.
- →The origin does not support SNI. Server Name Indication is how the server knows which site is being requested when several share an IP address.
- →Incompatible cipher suites. Cloudflare and your origin cannot agree on an encryption method they both accept.
How to fix it
Work down this list. Most 525s are solved by the first two.
- 1.Install a certificate at the origin. If there is nothing there, nothing else matters. Cloudflare offers a free Origin CA certificate specifically for this, and it is designed to be trusted by Cloudflare on the connection to your server.
- 2.Confirm port 443 is open to Cloudflare on your origin, or the custom secure port you set. Firewalls and hosting security rules block it more often than you would expect. If you use a non-standard secure port, check that too.
- 3.Review the cipher suites your origin offers. A server locked down to an unusual or very old set may have nothing in common with Cloudflare.
- 4.Read your origin error logs. Your web server records the failed handshake from its own side, which is normally the fastest way to see the real reason.
- 5.Check the origin status chart in Origin Analytics. It shows how your origin has been responding over time, which tells you whether this is constant or intermittent.
How 525 differs from the errors it gets confused with
Three errors look similar and are not.
The handshake completed, but Cloudflare rejected the certificate. See Cloudflare Error 526.
The same kind of failure, but between the visitor and the server. See ERR_SSL_PROTOCOL_ERROR.
A redirect loop between the proxy and the origin rather than a handshake failure. See ERR_TOO_MANY_REDIRECTS.
A DNS problem, where your records point somewhere Cloudflare will not proxy. See Cloudflare Error 1000.
A common way people walk into this
Putting Cloudflare in front of a hosted platform that already handles its own certificates is a reliable way to produce a 525. The platform expects to terminate the secure connection itself, and proxying it through Cloudflare breaks that arrangement.
Webflow is the classic example, and we cover the correct setup in our guide to security headers on Webflow.
If you want the certificate side checked from the outside first, run a free site check and look at the certificate result before you start changing settings.
Frequently asked questions
Is Error 525 dangerous for visitors?
No. Nothing reaches the visitor from your server at all, because the connection never completes. It is an availability problem, not a safety one. Your site is simply unreachable until the origin can complete a secure connection with Cloudflare.
Will switching my SSL/TLS mode make it go away?
It can, because the modes that do not encrypt the connection to your origin never attempt the handshake that is failing. That hides the error instead of fixing it, and it leaves the connection between Cloudflare and your server unencrypted. Install a certificate at the origin instead.
What is a Cloudflare Origin CA certificate?
It is a free certificate Cloudflare issues for the connection between Cloudflare and your origin server. It is not meant for browsers to trust directly, only for Cloudflare to trust on that internal hop. It is the simplest fix when your origin has no usable certificate. Read more about what a certificate is in our glossary entry on the SSL certificate.
Why does the site work sometimes and fail other times?
Intermittent 525s usually point at load or at one server in a pool being misconfigured. The origin status chart in Origin Analytics shows the pattern over time, and your origin error logs will show the failures from the server side.