526 Invalid SSL Certificate — What It Means and How to Fix It

What 526 means

Cloudflare completed a TLS handshake but rejected the certificate the origin presented. This only occurs in Full (Strict) mode, which requires a valid, publicly trusted certificate on the origin.

Common causes

•A self-signed certificate on the origin while in Full (Strict) mode.
•An expired origin certificate.
•A certificate whose hostname does not match the origin.
•An incomplete chain with intermediate certificates missing.
•A certificate from an untrusted authority.

How to fix it

Install a valid certificate on the origin, or install a free Cloudflare Origin CA certificate which is trusted in Full (Strict) mode. If the certificate looks valid but still fails, suspect a missing intermediate — browsers often paper over an incomplete chain and stricter clients do not.

Checking the certificate chain

A certificate can be valid and still fail here if the chain is incomplete. Browsers frequently paper over a missing intermediate by fetching it themselves, so a certificate that looks fine in Chrome can still be rejected by a stricter client like Cloudflare in Full (Strict) mode.\n\nVerify the chain from outside your network rather than trusting the browser. `openssl s_client -connect yourorigin:443 -servername yourdomain.com` prints the chain the server actually presents; if intermediates are missing, install the full bundle your certificate authority provides rather than the leaf certificate alone.\n\nCloudflare Origin CA certificates sidestep the whole problem. They are free, valid for up to 15 years, and trusted in Full (Strict) mode — but note they are trusted only by Cloudflare, so the origin must not be reachable directly by the public.

Catching 526 before your users report it

Certificate problems are predictable and therefore preventable. Expiry monitoring turns this outage into a calendar reminder.

Monitor for 526 responses free

Often confused with

525 SSL Handshake Failed 520 Web Server Returned an Unknown Error

← All HTTP status codes

526 Invalid SSL Certificate — questions

What is the difference between 525 and 526?

525 means the TLS handshake itself failed. 526 means the handshake completed but the certificate was rejected as invalid. Both usually resolve to a certificate problem on the origin.

Can I use a self-signed certificate with Cloudflare?

Only in Full mode, not Full (Strict). Rather than weakening the mode, install a Cloudflare Origin CA certificate — it is free and works with Full (Strict).

526