Read this first: Cloudflare is not the broken part
Cloudflare sits between your visitor and your real server. The visitor connects to Cloudflare, and Cloudflare connects to your origin.
A 526 is Cloudflare reporting that the second connection failed its certificate check. The error page carries Cloudflare branding, so people go hunting through the Cloudflare dashboard. The problem is on the server behind it.
Error 526: invalid SSL certificateCloudflare's own title uses a lowercase "invalid". If you are searching for the exact string, that is why the capitalisation looks inconsistent across guides.
525 or 526? The difference in one line
This is the thing worth remembering, because the two errors get treated as interchangeable and they are not.
The handshake never completed. Cloudflare could not even establish a secure connection. See Cloudflare Error 525.
The handshake completed, then the certificate failed validation. Your server is talking. Cloudflare just does not trust what it presented.
Two conditions have to be true
A 526 only appears when both of these hold at the same time:
- →Cloudflare cannot validate the certificate presented by your origin server.
- →Your SSL/TLS mode is Full (strict), which is the mode where Cloudflare insists the origin certificate is genuinely valid rather than merely present.
How to fix it
The last option is the real fix. The first is the fast one, with a cost.
- 1.Switch to Full instead of Full (strict). This makes the error stop immediately, because Full does not validate the origin certificate. Be honest with yourself about what that means: you have not fixed anything, you have told Cloudflare to check less. Use it to restore service, then keep going.
- 2.Add a self-signed certificate to the Custom Origin Trust Store if you deliberately run your own certificate at the origin. This lets you stay on Full (strict) while trusting a certificate you control.
- 3.Use a Cloudflare Origin CA certificate. It is free, made for exactly this connection, and Cloudflare trusts it out of the box.
- 4.Verify the certificate on your origin properly. It must not be expired or revoked, it must be signed by a certificate authority, the names on it must match, and it must serve a complete chain. Port 443 also has to be reachable.
Why "just switch to Full" is not the answer
It is tempting, and plenty of guides stop there. It works in the sense that the error disappears.
But Full (strict) exists for a reason. It is the setting that confirms the server Cloudflare is sending your visitors' data to is genuinely your server. Turning it off removes that assurance. The traffic is still encrypted, but the identity check is gone.
So use Full to get back online if you are mid outage. Then get a valid certificate onto the origin and switch back. That is the actual fix.
Related errors worth ruling out
If your symptoms do not quite match, these are the neighbours:
Error 525 for a handshake that never completes. Error 1000 if your DNS points somewhere Cloudflare will not proxy. ERR_SSL_PROTOCOL_ERROR when the failure is between the visitor and the server rather than Cloudflare and the server. ERR_TOO_MANY_REDIRECTS when the proxy and origin disagree about HTTPS and loop.
To see the certificate as the outside world sees it, run a free site check.
Frequently asked questions
What is the difference between Error 525 and Error 526?
Error 525 means the secure handshake between Cloudflare and your origin never completed. Error 526 means the handshake completed, and then Cloudflare rejected the certificate your origin presented. One is a connection failure, the other is a trust failure.
Why does the error only appear on Full (strict)?
Full (strict) is the mode where Cloudflare validates the origin certificate rather than just encrypting to it. On other modes the same invalid certificate is still there, but nothing checks it, so nothing reports it.
My certificate is valid in a browser. Why does Cloudflare reject it?
The usual cause is an incomplete chain. Many browsers work around a missing intermediate certificate, and stricter clients do not. Check that your origin serves the full chain, and that the names on the certificate cover the hostname Cloudflare is requesting. Our glossary entry on the SSL certificate explains what a chain is.
Is a self-signed certificate acceptable at the origin?
It can be, if you add it to the Custom Origin Trust Store so Cloudflare knows to trust it. A self-signed certificate that Cloudflare has never been told about will fail validation under Full (strict), which is exactly this error.