Cloudflare Error 525: SSL Handshake Failed and Cloudflare Error 526: Invalid SSL Certificate both mean Cloudflare could not complete a secure SSL/TLS handshake with your origin server. This happens when your Cloudflare SSL mode is set to Full or Full (Strict) but the origin certificate is missing, invalid, expired, or self-signed. The fix is to make sure the origin has a valid certificate, which our free AutoSSL provides, and to set the Cloudflare SSL mode to match. Never use Flexible.
Confirm AutoSSL issued a valid cert, then set SSL to Full (Strict)
These errors come from a mismatch between Cloudflare's SSL mode and the certificate on your origin. First confirm our free AutoSSL has issued a valid certificate for the domain in cPanel. Then set the Cloudflare SSL mode to Full (Strict). With a valid origin cert in place, the handshake completes and both 525 and 526 clear.
01. 525 Versus 526
These two codes are closely related, and the distinction tells you where to look.
- Error 525: SSL Handshake Failed - Cloudflare started a TLS handshake with the origin but it did not complete. The origin may not be serving HTTPS, may lack a certificate, or may have a protocol or cipher mismatch.
- Error 526: Invalid SSL Certificate - the handshake got far enough to present a certificate, but Cloudflare rejected it. This fires when the mode is Full (Strict) and the origin cert is expired, self-signed, or does not match the hostname.
Both are origin-certificate problems. The difference is that 526 specifically means Full (Strict) validated the cert and refused it, while 525 means the handshake itself broke.
02. Ensure the Origin Has a Valid Certificate
For Full or Full (Strict) to work, the origin must present a valid, trusted, current certificate. On our platform you do not need to buy one. Free AutoSSL issues and renews a valid certificate for your domain automatically.
- Check SSL status in cPanel - open the SSL/TLS Status page and confirm the domain shows a valid, current certificate.
- Confirm coverage - make sure the exact hostname Cloudflare connects to, including the www and non-www forms, is covered.
- Run AutoSSL if needed - if the certificate is absent, trigger AutoSSL and wait for it to issue.
If AutoSSL has not issued a certificate, that is the root cause and must be fixed first. Our AutoSSL Not Issuing - How to Fix SSL Certificate Errors guide walks through the common blockers. For a general grounding in how certificates and HTTPS work on your site, see SSL Certificates and HTTPS on Your Website.
03. Set the Correct Cloudflare SSL Mode
With a valid AutoSSL certificate on the origin, set the Cloudflare SSL/TLS encryption mode correctly. In the Cloudflare dashboard go to SSL/TLS and choose the overview mode.
- Full (Strict) - recommended. Cloudflare encrypts to the origin and validates the certificate. This is the right mode once AutoSSL has issued a valid cert.
- Full - encrypts to the origin but does not strictly validate the cert. A workable fallback, but Full (Strict) is better with a valid AutoSSL cert.
- Flexible - do not use this. It leaves the Cloudflare-to-origin leg unencrypted and commonly causes redirect loops on our servers because the site also forces HTTPS.
Never set the mode to Flexible on our platform. Because AutoSSL already serves HTTPS at the origin, Flexible produces redirect loops and mixed-content problems. Use Full (Strict) with a valid certificate.
04. Expired or Mismatched Certificate
If the certificate exists but is expired or does not match the hostname, Full (Strict) will reject it with a 526. AutoSSL renews automatically, but a renewal can stall if domain validation fails, for example when DNS or a redirect blocks the validation check.
- Check the expiry - in cPanel SSL/TLS Status, confirm the certificate is current and not expired.
- Check the hostname - make sure the cert matches the domain and subdomain Cloudflare connects to.
- Reissue if needed - run AutoSSL again to reissue. If it will not issue, work through the AutoSSL guide linked above to clear the validation blocker.
Certificate validation for AutoSSL goes to the origin, not through Cloudflare. If a redirect or firewall rule blocks the validation request, renewal fails silently and you later see a 526 when the old cert expires.
Still Seeing Error 525 or 526?
If AutoSSL shows a valid current certificate and the mode is Full (Strict) but the error persists, open a ticket with the Cloudflare Ray ID and the affected domain so we can inspect the origin certificate and the handshake.
Open a Support TicketFrequently Asked Questions
What do Cloudflare Error 525 and 526 mean?
Both are SSL handshake failures between Cloudflare and your origin server. A 525 means the TLS handshake with your origin failed. A 526 means Cloudflare could not validate the SSL certificate on your origin. Both happen on the Cloudflare-to-origin leg, not between the visitor and Cloudflare.
How do I fix a Cloudflare 525 SSL handshake failed error?
Make sure your origin has a valid, working SSL certificate on port 443 and that your Cloudflare SSL/TLS mode matches it. On UWH hosting, AutoSSL provides a valid certificate, so set Cloudflare's SSL mode to Full (strict) once the certificate is issued. A 525 often appears when the mode is Full (strict) but the origin certificate is missing or expired.
What causes a 526 Invalid SSL Certificate error?
A 526 means Cloudflare is set to Full (strict) but the certificate on your origin is expired, self-signed, for the wrong hostname, or otherwise not trusted. Install or renew a valid certificate on the origin, or if the certificate is genuinely valid, confirm the hostname on it matches your site.
Which Cloudflare SSL mode should I use?
Use Full (strict) whenever your origin has a valid certificate, which is the case on UWH hosting with AutoSSL, because it encrypts and validates the origin connection. Avoid Flexible mode, since it leaves the Cloudflare-to-origin leg unencrypted and can cause redirect loops.
Quick Recap
- 525 and 526 are SSL problems - 525 is a failed handshake, 526 is a cert that Full (Strict) rejected.
- Get a valid origin cert - free AutoSSL issues one automatically in cPanel.
- Use Full (Strict) - the correct mode once the origin cert is valid.
- Never use Flexible - it causes redirect loops on our servers.
- Reissue expired certs - run AutoSSL again and clear any validation blocker.
Troubleshooting Cloudflare errors · Last updated November 2026 · Browse all Errors articles
Part of our Troubleshooting Cloudflare Errors series.
