# Errors 525 and 526: origin TLS failures

The error taxonomy puts these in the `ssl` category: the origin's TLS configuration is broken. Retrying does not help until the operator fixes the origin.

- **525 SSL handshake failed**: Cloudflare and the origin could not complete a TLS handshake. Causes: the origin does not speak TLS on the port Cloudflare connects to, protocol/cipher mismatch, or the origin requires SNI Cloudflare did not send correctly.
- **526 Invalid SSL certificate**: the handshake worked but the certificate is invalid: expired, self-signed, or for the wrong hostname. This only happens in **Full (strict)** mode, which validates the origin cert.

## The fixes

- 526 with a self-signed or expired origin cert: either install a valid cert (Cloudflare Origin CA certs are free) or drop to **Full** mode (encrypted but not validated). Do not drop to Flexible: that reintroduces the redirect-loop risk and downgrades security.
- 526 with a hostname mismatch: the cert must cover the hostname Cloudflare connects to, which may differ from the public hostname if Origin Rules rewrite it.
- 525: check the origin actually serves TLS on 443, that its TLS stack is not ancient (TLS 1.0-only origins fail modern handshakes), and that SNI requirements are met.

## Checklist

- Read the error category: `ssl` means TLS, stop debugging the app.
- Full (strict) + valid cert is the target state; Full is the fallback, never Flexible.
- Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) becomes an outage, not a quiet fallback.