ExplainerSep 12, 20265 min read

Cloudflare 52x errors, explained by where the request died

520, 522, 524 and 525 each name a different hop between the edge and your origin. Draw the path once and the fix is obvious.

Start reading ↓

A browser talks to Cloudflare; Cloudflare talks to your origin. Every 52x code means the second conversation failed, and the number says at which step.

  • 522: the TCP connection to your origin never completed. Firewall, wrong IP, or the server is down.
  • 525: TCP worked, but the TLS handshake failed. Usually SSL mode Full (strict) with an origin that has no valid certificate.
  • 524: TCP and TLS worked, the request was sent, and the origin took more than 100 seconds to answer.
  • 520: the origin answered with something Cloudflare could not parse, often an empty reply or a reset connection.
522Critical↻ retryableConnection timed outCloudflare could not complete a TCP handshake with your origin within ~19 seconds. Allow Cloudflare IP ranges in your firewall, check the origin IP in DNS, and confirm the server listens on 0.0.0.0:443/80.

Test the hop yourself

terminal
# Bypass the edge and hit the origin directly with the right SNI
curl -sv --resolve example.com:443:203.0.113.10 https://example.com/health

If that hangs, it is a 522 problem: open your firewall to Cloudflare’s published IP ranges. If it fails during the handshake, it is 525: install an origin certificate.

525CriticalSSL handshake failedCloudflare reached your origin on 443 but the TLS handshake failed (SSL mode Full or Full (strict)). Serve a certificate for the hostname on port 443 with SNI and TLS 1.2+, or install a Cloudflare Origin CA cert.
Tip

A 502 or 504 with Cloudflare branding came from the edge. One without it came from your own proxy. Check which server header is in the response before you debug the wrong box.