Cloudflare Error 526: Invalid SSL Certificate on the Origin

Cloudflare error 526, "Invalid SSL certificate", means Cloudflare refused the certificate on your origin server. Visitors reach Cloudflare fine, but Cloudflare won't connect onward to your server, so everyone gets the error page.

Why it happens

With the SSL/TLS mode set to Full (strict), Cloudflare checks the origin's certificate the way a browser would. Error 526 means that check failed, almost always for one of these reasons:

• The origin certificate expired. The most common cause. Nobody notices, because visitors see Cloudflare's certificate, which is fine.
• It isn't from a trusted CA. A self-signed certificate fails. A certificate from a public CA passes, and so does a Cloudflare Origin CA certificate.
• It doesn't cover the hostname. The certificate must list the hostname Cloudflare connects for, such as www.example.com, in its Subject Alternative Names.
• The chain is incomplete. The origin sends only its own certificate, without the intermediate.

Error 525 is the related one: the TLS handshake itself failed, usually because the origin doesn't serve HTTPS on that port or offers no protocol or cipher Cloudflare accepts.

How to find which one

Connect to the origin directly, past Cloudflare, with the hostname Cloudflare would use:

openssl s_client -connect ORIGIN_IP:443 -servername www.example.com -showcerts </dev/null | openssl x509 -noout -dates -subject -ext subjectAltName

That shows the expiry date and the names on the origin certificate. If s_client also reports a verification error, it names the trust or chain problem.

How to fix it

1. Expired: renew the origin certificate and reload the web server.
2. Self-signed or wrong names: install a certificate from a public CA, or a Cloudflare Origin CA certificate covering every proxied hostname. Origin CA certificates are trusted only by Cloudflare, so anyone reaching the origin directly gets a warning.
3. Incomplete chain: install the full chain file, not just the certificate.

Don't fix it by switching to plain Full mode. It makes the error go away by accepting any certificate, including an expired or forged one, so traffic between Cloudflare and your server is no longer protected against interception.

Why monitoring missed it

An external check sees Cloudflare's edge certificate, which is valid, so it stays green while your origin certificate runs out. Watch the origin certificate's own expiry date as well as the edge. Scan your domain free to check the edge certificate visitors see.