Proudly Canadian 
Cloudflare SSL errors 525 and 526 are among the most confusing errors a site owner can encounter, because from the visitor's perspective the site appears to have an SSL problem when in reality the issue is specifically in the connection between Cloudflare and your origin server, not between Cloudflare and the visitor. Visitors see a secure HTTPS connection to Cloudflare. It is the second leg of the journey, from Cloudflare's servers to yours, where the problem occurs.
Understanding this distinction is the key to diagnosing and fixing these errors correctly. This guide explains what each error actually means, why it happens, and how to resolve it for the most common hosting environments.
Quick Summary
- Error 525 means the SSL handshake between Cloudflare and your origin server failed, typically because SSL is not installed or not active on your server
- Error 526 means Cloudflare completed the handshake but found an invalid certificate on your origin server
- The fix in most cases is to install a valid SSL certificate on your origin server and set your Cloudflare SSL mode to Full or Full (Strict)
- Cloudflare Origin Certificates are a reliable way to satisfy Full (Strict) mode requirements without depending on AutoSSL
How Cloudflare SSL Modes Work
When a visitor accesses your site through Cloudflare, there are two separate connections involved. The first is between the visitor's browser and Cloudflare's edge servers. The second is between Cloudflare's edge servers and your origin web server. Cloudflare's SSL mode settings control how the second connection is handled.
Flexible mode means Cloudflare connects to your origin server over plain HTTP on port 80, even though visitors see HTTPS. No SSL certificate is required on your server in this mode, and neither error 525 nor 526 can occur. The trade-off is that traffic between Cloudflare and your server is unencrypted, which is a security risk for sites handling any sensitive data.
Full mode means Cloudflare connects to your origin server over HTTPS on port 443. A certificate must be present on your server, but Cloudflare does not verify whether the certificate is valid, trusted, or has a matching domain. A self-signed, expired, or mismatched certificate will still satisfy Full mode. This prevents error 525 in most cases, but if the SSL handshake itself cannot complete, the error can still occur.
Full (Strict) mode means Cloudflare connects over HTTPS and additionally validates the certificate. The certificate must be from a trusted certificate authority, must not be expired, and must match the domain being accessed. A self-signed certificate will not satisfy Full (Strict) mode and will trigger error 526. This is the most secure mode and the one recommended for any site handling real user data.
Off mode means Cloudflare does not use SSL at all between itself and your server. Visitors may see HTTP in their browser or be redirected to HTTPS by Cloudflare while the backend connection is unencrypted. This mode is rarely appropriate.
Understanding Error 525: SSL Handshake Failed
Error 525 occurs when Cloudflare attempts to establish an encrypted connection with your origin server and the TLS handshake cannot complete. The handshake is the initial exchange of information that establishes a secure connection before any data is transferred. If it fails, no connection can be made at all.
The most common reasons for a failed handshake are that there is no SSL certificate installed on the origin server, the web server process is not configured to listen on port 443, a firewall is blocking Cloudflare's connection on port 443, or there is a cipher suite mismatch where Cloudflare and your server cannot agree on a common encryption method.
In cPanel environments, this often happens when a domain is set up but AutoSSL has not yet run or has failed, leaving the domain without a certificate. It can also happen when a certificate exists but the web server configuration has not been updated to use it. The certificate might appear in the SSL/TLS section of cPanel without the site actually being served over HTTPS.
In non-cPanel VPS or dedicated server environments, error 525 frequently appears when Nginx or Apache has not been configured to handle HTTPS traffic, or when the SSL virtual host block is absent or incorrectly configured.
Understanding Error 526: Invalid SSL Certificate
Error 526 occurs when Cloudflare can reach your origin server over port 443 and a TLS handshake succeeds, but the certificate it finds does not pass Cloudflare's validation checks. This error is specific to Full (Strict) mode. In Full mode, Cloudflare accepts any certificate regardless of its validity and would not produce error 526.
The certificate conditions that trigger error 526 include the certificate being expired, the certificate being self-signed and therefore not trusted by a public certificate authority, the certificate being issued for a different domain name than the one Cloudflare is connecting to, and the certificate chain being incomplete, meaning intermediate certificates are missing that would allow Cloudflare to trace the certificate back to a trusted root authority.
A common scenario is a site where AutoSSL successfully issued a Let's Encrypt certificate, but the certificate later expired without being renewed, while the Cloudflare SSL mode remains on Full (Strict). The site worked for months and then suddenly shows error 526 when the certificate expiry window passes.
Another scenario is a developer who installed a self-signed certificate for testing purposes, set the Cloudflare SSL mode to Full (Strict) for security, and then saw error 526 immediately because the self-signed certificate is not trusted by Cloudflare's validation.
Step-by-Step Fix for Error 525
Step 1: Verify whether SSL is installed and active on your origin server
The fastest way to check is to try accessing your domain directly via HTTPS by bypassing Cloudflare. You can do this by temporarily setting your Cloudflare DNS record for your domain to DNS-only mode by clicking the orange cloud icon in the DNS tab to make it grey. This causes your domain to resolve directly to your server IP. Then try visiting https://yourdomain.com in a browser. If the browser shows a connection error or a certificate warning, your server either has no certificate or has a misconfigured one.
You can also test from the command line without changing DNS settings by specifying the IP directly:
curl -Iv https://yourdomain.com --resolve yourdomain.com:443:YOUR_SERVER_IP
This forces the request to go directly to your server's IP on port 443 and shows you exactly what the server responds with.
Step 2: Install or renew the SSL certificate on your server
In cPanel, navigate to the Email section and open Email Deliverability, or go directly to SSL/TLS and then SSL/TLS Status. If your domain shows as not secured or shows a certificate error, click Run AutoSSL or use the Install button to install a certificate. AutoSSL will attempt to issue a free Let's Encrypt certificate for the domain.
If AutoSSL fails, the most common reasons are that your domain's DNS is not pointing to your server, that port 80 is blocked preventing HTTP domain validation, or that a Cloudflare proxy is intercepting the validation request. For the last case, temporarily switch your Cloudflare DNS record to DNS-only mode for the duration of the AutoSSL run, then re-enable the proxy once the certificate is issued.
On a VPS or dedicated server, install a certificate through your web server configuration using Let's Encrypt via Certbot, or use a Cloudflare Origin Certificate as an alternative.
Step 3: Confirm port 443 is open and the web server is listening
A certificate being installed does not automatically mean the web server is serving HTTPS traffic. On a VPS, check that your Nginx or Apache configuration includes an SSL virtual host block listening on port 443. Also verify your firewall allows inbound connections on port 443 from Cloudflare's IP ranges, which are published at cloudflare.com/ips.
Step 4: Set your Cloudflare SSL mode to Full or Full (Strict)
In your Cloudflare dashboard, go to SSL/TLS, then Overview. Set the encryption mode to Full if you have a self-signed certificate installed, or Full (Strict) if you have a valid certificate from a trusted authority. Using Flexible mode when your server has a certificate configured can sometimes cause redirect loops, so Full mode is the correct setting once a certificate is in place.
Step-by-Step Fix for Error 526
Step 1: Check the certificate currently installed on your server
Use SSL Labs' server test at ssllabs.com/ssltest to scan your domain. This shows the certificate that is currently installed on your server, its expiry date, the domain it was issued for, and whether the certificate chain is complete. You can also use the browser test by temporarily setting your DNS to bypass Cloudflare and visiting your domain over HTTPS directly.
Step 2: Identify the specific validation problem
Based on what you find, the fix differs. If the certificate is expired, renew it through cPanel's AutoSSL or by running Certbot on your server. If the certificate is self-signed, either switch your Cloudflare SSL mode to Full rather than Full (Strict), or replace the self-signed certificate with one from a trusted authority. If the certificate was issued for a different domain, check whether the correct certificate is installed for your primary domain, or reissue the certificate for the right domain name.
Step 3: Use a Cloudflare Origin Certificate if needed
If you want to use Full (Strict) mode but are having repeated issues with certificate renewals on your origin server, a Cloudflare Origin Certificate is a reliable alternative. This is a free certificate issued by Cloudflare itself and trusted by Cloudflare's proxy servers. It is not trusted by browsers on its own, so it only works when Cloudflare's proxy is active, but that is sufficient for the origin-to-Cloudflare connection.
To generate a Cloudflare Origin Certificate, go to your Cloudflare dashboard, select your domain, navigate to SSL/TLS, then Origin Server, and click Create Certificate. Select the key type and the domains you want covered, then choose a validity period. Copy the certificate and private key that Cloudflare generates. You will not be able to retrieve the private key again after closing this window, so save it securely.
Install the certificate and key on your origin server. In cPanel, go to SSL/TLS, then Manage SSL Sites, and install the certificate and key for your domain. After installation, verify by checking the SSL/TLS Status section and ensuring the domain shows as secured.
Managing SSL and Cloudflare Through WHMCS
If your hosting is managed through our client portal, you can view your SSL certificate status and request support directly from your WHMCS client area. Navigate to My Services, click on your hosting package, and look for SSL or certificate information in the product details. If your certificate shows as expired or invalid, open a support ticket from the same page with your domain name and a brief description of what you are seeing.
If you are managing a reseller account and need to resolve SSL issues across multiple client domains, the Email Deliverability tool in WHM gives you a server-wide view of SSL status and allows you to run AutoSSL for any domain without logging into each individual cPanel account.
Checking Whether the Fix Worked
After making changes to your SSL certificate or Cloudflare SSL mode, the fix should take effect quickly for SSL mode changes, usually within a minute or two. Certificate installation may take a few minutes to propagate within the web server configuration. You can test by visiting your site in a browser and checking that no SSL error appears, then confirming in Cloudflare's SSL/TLS overview that the mode is set correctly.
For a more thorough check, use the SSL Labs server test at ssllabs.com/ssltest against your domain. If Cloudflare's proxy is active, this test will show you Cloudflare's certificate on the visitor-facing side. To test the origin certificate specifically, you can scan your server's IP directly in SSL Labs or use the curl command shown in the Step 1 section above.
If after all changes the error persists, check your Cloudflare error logs under the Analytics section of your dashboard. The Error Analytics tool shows error rates by type and can help identify whether the problem is consistent or intermittent, which often points to different root causes.
Preventing These Errors in the Future
Error 525 and 526 are most often preventable with a few ongoing practices. Keep SSL certificates renewed before they expire. AutoSSL in cPanel attempts renewal 30 days before expiry, but it can fail if DNS or port 80 access is temporarily disrupted. Monitor your certificate expiry dates using a tool like UptimeRobot's SSL monitoring feature or a service like SSL Shopper's certificate checker. You can set up email alerts when expiry is approaching.
When you change your Cloudflare SSL mode, test immediately after the change. Moving from Flexible to Full or Full (Strict) without a certificate in place on the origin will produce error 525 right away. The correct sequence is to install the certificate first, verify it is valid, then update the Cloudflare SSL mode.
When migrating a site to a new server, ensure the certificate is installed and tested on the new server before updating DNS to point to it. Migrating DNS without a working certificate on the destination causes the SSL errors to appear immediately and can be difficult to diagnose after the fact since you are now behind a different server.
Gotekky
Need help deciding what to do next?
Tell us what you are seeing and what outcome you need. We will identify whether a managed service, scoped project or paid technical assessment is the right next step.