Cloudflare Errors 525/526: the origin TLS handshake is broken

Errors 525 and 526: origin TLS failures

The error taxonomy puts these in the ssl category: the origin's TLS configuration is broken. Retrying does not help until the operator fixes the origin.

• 525 SSL handshake failed: Cloudflare and the origin could not complete a TLS handshake. Causes: the origin does not speak TLS on the port Cloudflare connects to, protocol/cipher mismatch, or the origin requires SNI Cloudflare did not send correctly.
• 526 Invalid SSL certificate: the handshake worked but the certificate is invalid: expired, self-signed, or for the wrong hostname. This only happens in Full (strict) mode, which validates the origin cert.

The fixes

• 526 with a self-signed or expired origin cert: either install a valid cert (Cloudflare Origin CA certs are free) or drop to Full mode (encrypted but not validated). Do not drop to Flexible: that reintroduces the redirect-loop risk and downgrades security.
• 526 with a hostname mismatch: the cert must cover the hostname Cloudflare connects to, which may differ from the public hostname if Origin Rules rewrite it.
• 525: check the origin actually serves TLS on 443, that its TLS stack is not ancient (TLS 1.0-only origins fail modern handshakes), and that SNI requirements are met.

Checklist

• Read the error category: ssl means TLS, stop debugging the app.
• Full (strict) + valid cert is the target state; Full is the fallback, never Flexible.
• Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) becomes an outage, not a quiet fallback.

Verified against the live error responses taxonomy (525/526 = ssl category, origin TLS broken, retry futile) and SSL modes doc (Full vs Full strict, Automatic SSL/TLS never downgrades). Refs: https://developers.cloudflare.com/fundamentals/reference/error-responses/ and https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/