CloudflareRunbook 0/4 done
525

Cloudflare Error 525: SSL handshake failed

Critical✕ Not retryable · fix the payloadHTTP 525 SSL Handshake FailedCDN / Edge
TL;DR · 10-second read

Cloudflare reached your origin on 443 but the TLS handshake failed (SSL mode Full or Full (strict)). Serve a certificate for the hostname on port 443 with SNI and TLS 1.2+, or install a Cloudflare Origin CA cert.

Identify: does your log match?

What you see · exact log / response
HTTP/2 525
server: cloudflare
cf-ray: 8d2f6b2e1d4c5a90-AMS

Error 525 Ray ID: 8d2f6b2e1d4c5a90 • 2026-10-18 07:41:12 UTC
SSL handshake failed
  1. High

    No certificate configured on 443

    The origin listens on 443 without TLS, or the vhost for this hostname has no ssl_certificate, so the handshake aborts.

  2. Medium

    SNI not supported or wrong vhost

    Cloudflare always sends SNI. If the origin has no matching server block it may close the connection.

  3. Low

    No overlapping cipher or protocol

    The origin only allows TLS 1.0/1.1 or exotic ciphers that Cloudflare no longer offers.

Fix

Test the origin handshake directly, then issue a cert

✕ Broken · CLI
curl https://www.example.com   # goes through Cloudflare, hides the origin error
✓ Fixed · CLI
# talk to the origin IP with the real SNI
openssl s_client -connect 203.0.113.10:443 -servername www.example.com -tls1_2 </dev/null

# issue a cert on the origin
sudo certbot --nginx -d example.com -d www.example.com

s_client shows the exact alert (handshake failure, no peer certificate). Once a valid cert is served, Full (strict) mode works.

Verify: reproduce it on purpose

Reproduce locally · openssl
$ openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null

Run it against a dev environment to trigger 525 on purpose and test your error handler.

Prevent

  • Use Full (strict), never Flexible, once the origin has a cert.
  • Renew origin certs automatically (certbot timer).
  • Test origin TLS in CI with openssl s_client.

FAQ

Should I switch SSL mode to Flexible to fix 525?

It hides the error but sends traffic to your origin unencrypted and often causes redirect loops. Install a certificate instead.

What is the difference between 525 and 526?

525 means the handshake itself failed. 526 means it succeeded but the certificate was invalid under Full (strict).

Does Cloudflare Origin CA work in browsers?

No, it is only trusted by Cloudflare. That is fine because browsers talk to Cloudflare, not your origin.

Related errors

Last verified 2026-10-18 · Source: Cloudflare 1xxx and 5xx error reference · Official docs ↗ · ~12,100 searches/mo