Cloudflare error 526: invalid SSL certificate — causes and fix

Short answer: Cloudflare error 526 “Invalid SSL certificate” means Cloudflare connected to your origin server and got a TLS handshake back, but the certificate your server presented failed validation — and your zone’s SSL/TLS encryption mode is set to Full (strict), which refuses to proceed without a valid one. The connection itself works; the certificate does not pass. Fix the certificate (the right answer for a production site), or switch the mode to plain Full as a quick, less secure stopgap.

echo | openssl s_client -connect YOUR_ORIGIN_IP:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer

Replace example.com with the hostname Cloudflare proxies and YOUR_ORIGIN_IP with the server’s real address (behind a firewall that only admits Cloudflare’s ranges, run this on the server itself against 127.0.0.1 instead). This talks to the origin directly, bypassing Cloudflare, so it reproduces exactly what Cloudflare sees and fails on when it gets a 526.

Why this only happens on Full (strict)

Cloudflare’s SSL/TLS encryption modes decide how carefully it checks the certificate on the connection to your origin, not the one it shows visitors:

That is also the fast way to tell 526 apart from the two errors people confuse it with. 525 is a failed handshake — no usable TLS connection came up at all, often a protocol or cipher mismatch, or no certificate offered. 526 is the opposite: the handshake succeeds, a certificate comes back, and Cloudflare rejects that specific certificate on inspection.

What makes a certificate fail validation

• Expired. The single most common cause — an auto-renewal (certbot, ACME) silently stopped working months ago and nobody noticed until now.
• Self-signed, or signed by a CA Cloudflare doesn’t trust. Full (strict) requires a certificate chain that leads to a publicly trusted root, unless you have explicitly added that certificate to Cloudflare’s Custom Origin Trust Store or are using a Cloudflare Origin CA certificate (below).
• Hostname mismatch. The certificate’s Common Name or Subject Alternative Name list does not include the hostname being requested — a certificate issued for old.example.com still installed after the site moved to www.example.com, or a wildcard certificate that does not cover a subdomain two levels deep.
• Incomplete chain. The server sends only its own leaf certificate and not the intermediate CA certificate(s) that link it to a trusted root. Many clients and browsers paper over this by fetching the missing intermediate themselves; Cloudflare’s origin check does not.
• Revoked. Rare in practice, but a certificate the issuing CA has since revoked fails the same way.

How to fix it

1. 1Confirm the actual problem with openssl

   Run the command from the top of this page and read the output:

   notBefore=Jan 10 00:00:00 2025 GMT
   notAfter=Apr 10 23:59:59 2025 GMT
   subject=CN = example.com
   issuer=C = US, O = Let's Encrypt, CN = R10

   A notAfter date in the past is the expired case. For a chain problem, add -showcerts to the command and count how many BEGIN CERTIFICATE blocks come back — one means the leaf only, with the intermediate missing.

2. 2Renew or replace the certificate

   For Let’s Encrypt via certbot, check why auto-renewal stopped rather than only running it once more — a cron job that silently broke will expire the certificate again in 90 days:

   sudo certbot certificates           # see the actual expiry certbot has on file
   sudo certbot renew --dry-run        # test renewal without touching the live cert
   sudo systemctl status certbot.timer # confirm the renewal timer is actually enabled

   For an incomplete chain, make sure the server’s certificate file is thefull chain file your CA issued (often named fullchain.pem rather than cert.pem), not the leaf certificate alone.

3. 3Or use a Cloudflare Origin CA certificate

   If the connection is only ever going to come from Cloudflare — true for most sites that proxy every request — Cloudflare’s own free Origin CA certificates are the simplest fix: issue one from SSL/TLS → Origin Server in the dashboard, install it on your origin, and Full (strict) trusts it without any public CA involved. It is not valid for anyone who connects directly to the origin’s IP rather than through Cloudflare, which is normally what you want anyway.

4. 4Self-signed on purpose? Add it to the trust store

   For an internal or staging origin where a public certificate is not practical, Cloudflare’s Custom Origin Trust Store (also under SSL/TLS → Origin Server) lets Full (strict) accept one specific self-signed or private-CA certificate instead of requiring a publicly trusted chain.

5. 5Stopgap only: drop to Full

   Switching the zone’s SSL/TLS mode from Full (strict) to plain Full in the Overview tab makes the 526 disappear immediately, because Full encrypts the connection to the origin without validating the certificate at all. That is a real loss of security — it reopens the door to a man-in-the-middle between Cloudflare and your server presenting any certificate at all — so treat it as a way to buy time while you fix the certificate properly, not as the fix.

526 compared with the other 5xx errors

• 525 — SSL handshake failed: no usable TLS connection at all, before a certificate is even evaluated (see Cloudflare error 525).
• 522 — connection timed out: Cloudflare could not reach the origin on the right port in the first place — a firewall, DNS, or a stopped server, nothing to do with certificates.
• 521 — web server is down: the origin actively refused the TCP connection.
• 520 — web server returned an unknown error: the origin answered but with something unusable — an empty reply, a reset, or oversized headers.

If you are a visitor rather than the site operator, a 526 is not something reloading fixes — it is the site’s own certificate that needs attention. The same checks here also catch certificate problems unrelated to Cloudflare; see Your connection is not private for the browser-side version of the same family of errors, and SSL handshake failed for the handshake case directly.

Frequently asked