Cloudflare Error 526: Invalid SSL certificate

The TLS handshake got far enough for Cloudflare to look at your origin certificate — and it failed the exam. Full (strict) mode demands a valid, trusted cert on the origin; anything less becomes Error 526.

What visitors see

Error 526
Invalid SSL certificate
The origin SSL certificate is not valid or trusted.
Cloudflare Ray ID: …

Visitors never see your origin certificate when the proxy is on — they see Cloudflare’s edge cert. 526 means the hidden hop (Cloudflare → origin) failed certificate validation under Full (strict).

526 vs 525 vs common cert errors

Rule of thumb: Full allows almost any cert that lets the handshake finish. Full (strict) requires a cert Cloudflare trusts for that hostname. Switching Full → Full (strict) overnight is a common way to “suddenly” get 526.

Frequent real causes

• Expired origin certificate — Let’s Encrypt / other CA not auto-renewing; see certificate has expired.
• Self-signed or private CA — fine under Full; rejected under Full (strict) unless you use a Cloudflare Origin CA cert (issued for this purpose) or a public CA.
• Wrong hostname (CN/SAN) — cert is for www.example.com but Cloudflare connects with example.com (or an alternate Host). Same idea as ERR_CERT_COMMON_NAME_INVALID.
• Incomplete chain — leaf installed without intermediates; strict verifiers fail with “unable to get local issuer”.
• Mode set to Full (strict) before TLS was ready — origin still on a temporary self-signed cert from initial bootstrap.

Diagnose

# See what cert the origin presents (bypass Cloudflare):
openssl s_client -connect ORIGIN_IP:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

# Verify the chain the way a strict client would:
curl -vI https://ORIGIN_IP/ -H "Host: example.com" --connect-timeout 5
# (omit -k — a verify failure here under Full strict ≈ 526)

# Cloudflare dashboard:
# SSL/TLS → Overview → Full (strict)
# SSL/TLS → Origin Server → create Origin CA certificate if you want CF-only trust

If openssl shows an expired notAfter, a subject that does not list your hostname, or an issuer that is “self-signed”, you have found the 526. Handshake failures before any cert dumps belong on the 525 page.

Fix checklist

1. Confirm mode is Full (strict) — 526 is the strict-validation error. Under Full, the same self-signed cert usually works (handshake issues → 525 instead).
2. Install a valid origin certificate — preferred options:
   • Cloudflare Origin CA — dashboard → SSL/TLS → Origin Server; install the cert+key on nginx/Caddy; trusted by Cloudflare for your zone, not by browsers (fine — browsers only see the edge).
   • Let’s Encrypt / public CA — normal public cert with correct SANs and full chain; works for grey-cloud and Full strict alike.
3. Match every proxied hostname — SANs must cover the Host headers Cloudflare sends (apex + www + extras).
4. Serve the full chain — leaf + intermediates; fix “unable to get local issuer” before flipping strict back on.
5. Temporary stopgap only — switch Full (strict) → Full while you repair the cert. Do not switch to Flexible and leave the origin on HTTP long-term; that drops encryption on the CF↔origin hop. Never run Full against an HTTP-only origin (that becomes 525).
6. Automate renewal — certbot timers / Caddy auto-HTTPS / Origin CA with a calendar reminder (Origin CA can be long-lived — still track expiry).

# nginx sketch after installing Origin CA or LE files:
# ssl_certificate     /etc/ssl/origin/cert.pem;      # full chain
# ssl_certificate_key /etc/ssl/origin/key.pem;
# Then: sudo nginx -t && sudo systemctl reload nginx

Related

All Cloudflare error codes · Cloudflare Error 523 · Cloudflare Error 525 · certificate has expired · self-signed certificate in certificate chain · unable to get local issuer certificate · ERR_CERT_COMMON_NAME_INVALID · ERR_SSL_PROTOCOL_ERROR · SSL wrong version number · ERR_SSL_VERSION_OR_CIPHER_MISMATCH · Cloudflare Error 520 · Cloudflare Error 521 · Anvil HTTP status · Wirebook: when sites get tired

Questions

Published 7 November 2026.