525
Unofficial (Cloudflare)
525 SSL Handshake Failed: Certificate or Protocol Mismatch
✦ The Golden Answer: The 525 SSL Handshake Failed is a Cloudflare-specific status code. It indicates that the SSL/TLS handshake between Cloudflare and your origin server failed. This typically happens when the origin server's SSL certificate is invalid, expired, self-signed, or not trusted by Cloudflare. It can also occur when the server does not support the required TLS protocols (e.g., TLS 1.2 or 1.3). The fix involves installing a valid certificate from a trusted Certificate Authority, ensuring the certificate matches the domain, and configuring the server to support modern TLS versions.
Common Causes of 525 Errors
| Cause | Example | How to Fix |
|---|---|---|
| Expired SSL certificate | Certificate has passed its expiration date. | Renew the certificate and install the new one on the origin server. |
| Self-signed certificate | Origin uses a self-signed certificate not trusted by Cloudflare. | Install a certificate from a trusted CA, or set Cloudflare to "Full" or "Flexible" SSL (Flexible is not recommended). |
| Certificate not matching domain | Certificate is issued for a different domain. | Obtain a certificate that matches the domain name exactly (including www vs non-www). |
| Outdated TLS protocols | Origin server only supports TLS 1.0 or 1.1, which are deprecated. | Upgrade the server to support TLS 1.2 or 1.3. |
| Incomplete certificate chain | Intermediate certificates are missing. | Ensure the full certificate chain (including intermediates) is installed. |
| SSL configuration error | Server is not configured to accept HTTPS connections. | Check SSL configuration (e.g., Nginx ssl_certificate, ssl_certificate_key). |
Example: Cloudflare 525 Error Page
Cloudflare displays a user‑friendly error page for 525 errors:
HTTP/1.1 525 SSL Handshake Failed
Content-Type: text/html
<html>
<body>
<h1>525: SSL Handshake Failed</h1>
<p>The SSL/TLS handshake between Cloudflare and the origin server failed.</p>
</body>
</html>
How to Fix 525 Errors
- Check certificate validity: Verify that your SSL certificate is not expired and is issued by a trusted Certificate Authority. Use tools like
openssl s_client -connect yourdomain.com:443 -servername yourdomain.comto check the certificate. - Install full certificate chain: Ensure you have installed the certificate along with all intermediate certificates. Many CAs provide a full chain file.
- Match domain name: Make sure the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the domain exactly (including www prefix if used).
- Update TLS protocols: Configure your web server to support TLS 1.2 and 1.3, and disable older versions (TLS 1.0, 1.1).
- Test SSL configuration: Use online tools like SSL Labs SSL Server Test to check your SSL configuration for issues.
- If using self-signed: Either install a trusted certificate or set Cloudflare's SSL/TLS encryption mode to "Full" (not "Flexible") if you trust the self-signed certificate. However, "Full" still requires a valid certificate; for self-signed, you may need "Full (strict)" with a trusted CA.
Cloudflare SSL/TLS Modes
- Flexible: Cloudflare connects to the origin over HTTP, not HTTPS. This is insecure and not recommended.
- Full: Cloudflare connects to the origin over HTTPS but does not validate the certificate. This is acceptable if you trust the certificate (e.g., self-signed).
- Full (strict): Cloudflare validates the origin certificate against a trusted CA. This is the recommended mode for security.
If you are using a self-signed certificate, you must use "Full" mode or install a trusted certificate. For "Full (strict)", you need a valid certificate from a trusted CA.
Frequently Asked Questions
Is 525 a client error or a server error?
It is a server error (5xx) because the origin server's SSL configuration is the problem. Cloudflare is working correctly but cannot establish a secure connection.
Can I fix a 525 error from the client side?
No, it is a server‑side certificate configuration issue. Only the website owner or server administrator can fix it.
What is the difference between 525 and 526?
525 means the SSL handshake failed (e.g., certificate invalid, expired, or protocol mismatch). 526 means the handshake succeeded, but the certificate is invalid (e.g., expired or mismatched domain) — a more specific validation failure.