## TL;DR

Retrying does not help until the operator fixes the origin. - 525 SSL handshake failed: Cloudflare and the origin could not complete a TLS handshake.

## When to use

You are seeing this: The error taxonomy puts these in the ssl category: the origin's TLS configuration is broken. Use this skill when you run into "Cloudflare Errors 525/526: the origin TLS handshake is broken".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Errors 525 and 526: origin TLS failures

The error taxonomy puts these in the `ssl` category: the origin's TLS configuration is broken. Retrying does not help until the operator fixes the origin.

- **525 SSL handshake failed**: Cloudflare and the origin could not complete a TLS handshake. Causes: the origin does not speak TLS on the port Cloudflare connects to, protocol/cipher mismatch, or the origin requires SNI Cloudflare did not send correctly.
- **526 Invalid SSL certificate**: the handshake worked but the certificate is invalid: expired, self-signed, or for the wrong hostname. This only happens in **Full (strict)** mode, which validates the origin cert.

## The fixes

- 526 with a self-signed or expired origin cert: either install a valid cert (Cloudflare Origin CA certs are free) or drop to **Full** mode (encrypted but not validated). Do not drop to Flexible: that reintroduces the redirect-loop risk and downgrades security.
- 526 with a hostname mismatch: the cert must cover the hostname Cloudflare connects to, which may differ from the public hostname if Origin Rules rewrite it.
- 525: check the origin actually serves TLS on 443, that its TLS stack is not ancient (TLS 1.0-only origins fail modern handshakes), and that SNI requirements are met.

## Checklist

- Read the error category: `ssl` means TLS, stop debugging the app.
- Full (strict) + valid cert is the target state; Full is the fallback, never Flexible.
- Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) becomes an outage, not a quiet fallback.