526
Unofficial (Cloudflare)
526 Invalid SSL Certificate: Certificate Validation Failed
✦ The Golden Answer: The 526 Invalid SSL Certificate is a Cloudflare-specific status code. It indicates that the SSL/TLS handshake with the origin server succeeded, but the certificate presented by the origin is invalid. Unlike 525 (which is a handshake failure), 526 means the handshake worked, but the certificate itself fails validation — it may be expired, self-signed without a trusted chain, or does not match the domain name. Cloudflare rejects the connection because the certificate is not considered valid. The fix involves installing a valid certificate from a trusted Certificate Authority, or if using a self-signed certificate, adjusting Cloudflare's SSL/TLS mode to "Full" (which skips validation).
Common Causes of 526 Errors
| Cause | Example | How to Fix |
|---|---|---|
| Expired SSL certificate | Certificate has passed its expiration date. | Renew the certificate and install the new one on the origin server. |
| Self-signed certificate | Origin uses a self-signed certificate not trusted by Cloudflare. | Install a certificate from a trusted CA, or set Cloudflare SSL mode to "Full" to skip validation. |
| Certificate not matching domain | Certificate is issued for a different domain (e.g., CN mismatch). | Obtain a certificate that matches the domain name exactly (including www vs non-www). |
| Incomplete certificate chain | Intermediate certificates are missing, causing validation to fail. | Ensure the full certificate chain (including intermediates) is installed. |
| Certificate revoked | The certificate has been revoked by the CA. | Obtain a new certificate from the CA. |
Example: Cloudflare 526 Error Page
Cloudflare displays a user‑friendly error page for 526 errors:
HTTP/1.1 526 Invalid SSL Certificate
Content-Type: text/html
<html>
<body>
<h1>526: Invalid SSL Certificate</h1>
<p>The SSL certificate presented by the origin server is invalid.</p>
</body>
</html>
How to Fix 526 Errors
- Check certificate validity: Verify that your SSL certificate is not expired. Use tools like
openssl x509 -in certificate.crt -text -nooutto check the expiry date. - Install full certificate chain: Ensure you have installed the certificate along with all intermediate certificates. Many CAs provide a full chain file (often named
fullchain.pem). - Match domain name: Make sure the certificate's Common Name (CN) or Subject Alternative Name (SAN) matches the domain exactly (including www prefix if used).
- Use a trusted certificate: If you're using a self-signed certificate, either install a certificate from a trusted CA (e.g., Let's Encrypt, Comodo, DigiCert) or set Cloudflare's SSL/TLS encryption mode to "Full" (not "Full (strict)").
- Test SSL configuration: Use online tools like SSL Labs SSL Server Test to check your SSL configuration for issues.
Cloudflare SSL/TLS Modes and 526
- Flexible: Cloudflare connects to the origin over HTTP, not HTTPS. This mode does not use SSL certificates on the origin, so 526 will not occur.
- Full: Cloudflare connects to the origin over HTTPS but does not validate the certificate. This mode will ignore 526 errors and allow the connection even if the certificate is invalid.
- Full (strict): Cloudflare validates the origin certificate against a trusted CA. If the certificate is invalid (e.g., self-signed, expired, mismatch), Cloudflare will return 526.
If you are using a self-signed certificate, you must use "Full" mode to avoid 526 errors. For better security, use a trusted CA certificate and "Full (strict)" mode.
Frequently Asked Questions
Is 526 a client error or a server error?
It is a server error (5xx) because the origin server's SSL certificate is invalid. Cloudflare is working correctly but cannot trust the certificate.
What is the difference between 526 and 525?
525 means the SSL handshake itself failed (e.g., protocol mismatch, server not responding to SSL). 526 means the handshake succeeded, but the certificate is invalid (e.g., expired, self-signed, mismatched domain).
Can I fix a 526 error from the client side?
No, it is a server‑side certificate issue. Only the website owner or server administrator can fix it.