SSL Troubleshooting Guide

How to Fix Cloudflare Error 525 (SSL Handshake Failed)

Cloudflare Error 525 means the TLS handshake between Cloudflare and your origin server failed. This guide walks through SSL mode, origin certificates, port 443, and firewall checks so you can restore HTTPS quickly.

If you use Cloudflare in front of your website, SSL handshake failed (Error 525) means Cloudflare could reach your origin server, but the TLS handshake between Cloudflare and your server failed. Visitors see a Cloudflare error page instead of your site.

This is not the same as a browser-only certificate warning. Error 525 is specifically about the connection between Cloudflare and your origin. Fixing it usually means checking origin SSL, ports, and firewall rules, not just the edge certificate in Cloudflare.

What causes Cloudflare Error 525?

Common causes, in order of how often we see them:

Expired or invalid certificate on the origin server (not the Cloudflare edge cert)
Origin web server not listening on port 443 or TLS disabled
Wrong SSL/TLS mode in Cloudflare (for example Full vs Full Strict with a self-signed origin cert)
Firewall or security group blocking Cloudflare IP ranges from reaching port 443
Misconfigured cipher suites or outdated TLS on the origin
Origin server down or overloaded (handshake never completes)

Step 1: Confirm Cloudflare SSL/TLS mode

In Cloudflare: SSL/TLS → Overview.

Flexible encrypts browser → Cloudflare only. Origin can use HTTP. Error 525 is less common here, but misconfiguration still happens.
Full encrypts end-to-end. Origin must accept HTTPS, but a self-signed origin certificate can work.
Full (strict) requires a valid, trusted certificate on the origin. Expired or hostname-mismatched origin certs often trigger 525 or 526.

Match the mode to what your origin actually serves. If you use Full (strict), your origin certificate must be valid and match the hostname Cloudflare connects to.

Step 2: Check the origin certificate

SSH into your server or use your hosting panel and verify:

Certificate is not expired
Certificate covers the hostname Cloudflare uses (often your root domain or www)
Certificate chain is complete (leaf + intermediate, not missing intermediates)

Quick checks from a machine that can reach the origin directly (bypassing Cloudflare if possible):

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

Look for Verify return code: 0 (ok) and the correct subject / DNS names. See our certificate chain glossary entry if chain errors appear.

Step 3: Verify port 443 and the web server

Confirm your web server (nginx, Apache, Caddy, etc.) is listening on 443 and serving TLS:

nginx: listen 443 ssl; with valid ssl_certificate paths
Apache: SSLEngine on and correct SSLCertificateFile
After renewals, reload the web server (systemctl reload nginx or equivalent)

A renewed certificate on disk that the running process has not loaded is a frequent post-renewal cause of 525.

Step 4: Allow Cloudflare IPs to reach origin

If your origin firewall only allows certain IPs, you must allow Cloudflare IP ranges. Blocking them can cause intermittent or total handshake failures.

Step 5: Test without Cloudflare (temporarily)

Pause Cloudflare (orange cloud → grey) for a test subdomain or use a direct origin URL if your host provides one. If TLS works direct but fails through Cloudflare, focus on SSL mode and origin trust. If it fails both ways, the problem is on the origin.

When Error 525 is really an expiry problem

Auto-renewal can succeed on the control panel while the web server still serves the old certificate. Renewal emails stop. Monitoring does not. That is why we built SSL reminder emails, status change alerts, and portfolio monitoring: to catch origin expiry before Cloudflare (and your visitors) do.

If your origin cert expired, renew it, install the full chain, reload the server, then confirm in Cloudflare that Full (strict) validates cleanly.

FAQ

Is Error 525 always Cloudflare's fault?

No. Cloudflare is reporting that the origin handshake failed. The fix is almost always on the origin server, certificate, or SSL mode setting.

What's the difference between Error 525 and 526?

525 is handshake failure. 526 is invalid SSL certificate on the origin (common under Full strict). See our Error 526 guide.

Can a valid Cloudflare edge certificate still show 525?

Yes. The visitor may see Cloudflare branding, but the edge cannot complete TLS to your origin. Edge and origin certificates are separate.

Keep reading