SSL Handshake Failed
ActiveHTTP 525 SSL Handshake Failed is a Cloudflare-specific status meaning the TCP connection to the origin succeeded, but the TLS handshake between Cloudflare and the origin server failed. Common causes: the origin's SSL certificate is invalid, expired, self-signed without proper Cloudflare configuration, or the origin doesn't support the TLS versions or cipher suites Cloudflare requires.
Description
525 occurs at the TLS layer – after TCP connects (unlike 522/523) but before any HTTP is exchanged. Cloudflare attempts a TLS handshake with the origin server. If the handshake fails for any reason – certificate error, protocol mismatch, cipher suite incompatibility – Cloudflare returns 525 to the client. This is specific to Cloudflare's Full or Full (Strict) SSL modes where Cloudflare re-encrypts to the origin. Flexible SSL mode (Cloudflare encrypts to client, plain HTTP to origin) would not produce a 525.
Examples
# Test TLS handshake directly to origin IP (bypassing Cloudflare)
openssl s_client -connect YOUR_ORIGIN_IP:443 -servername example.com
# Check certificate expiry
echo | openssl s_client -connect YOUR_ORIGIN_IP:443 2>/dev/null | openssl x509 -noout -dates
# Test which TLS versions origin supports
openssl s_client -connect YOUR_ORIGIN_IP:443 -tls1_2
openssl s_client -connect YOUR_ORIGIN_IP:443 -tls1_3# Flexible: Cloudflare to client = HTTPS, Cloudflare to origin = HTTP
# → No 525 possible, but origin traffic is unencrypted
# Full: Cloudflare to origin = HTTPS, but any certificate accepted
# → 525 if origin has no SSL at all or TLS version mismatch
# Full (Strict): Cloudflare to origin = HTTPS, valid certificate required
# → 525 if certificate is self-signed, expired, or wrong hostnameEdge Cases
- •A self-signed certificate on the origin causes 525 in Full (Strict) mode but not in Full mode – use Cloudflare Origin CA certificates for self-signed origins.
- •If the origin only supports TLS 1.0/1.1 and Cloudflare requires TLS 1.2+, a 525 results. Update the origin's TLS configuration.
- •SNI mismatch: if the origin certificate's CN/SAN doesn't match the hostname Cloudflare uses to connect, the handshake may fail in strict mode.
- •Let's Encrypt certificates older than 90 days expire and cause 525 if auto-renewal fails. Monitor certificate expiry on origin servers.
When You'll See This
- →Origin SSL certificate expired
- →Origin SSL certificate self-signed without Cloudflare Origin CA (in Full Strict mode)
- →Origin only supports TLS 1.0 – Cloudflare requires TLS 1.2+
- →Origin server doesn't have SSL installed at all (in Full or Full Strict mode)
- →Hostname mismatch between Cloudflare's request and origin certificate CN/SAN
- →Cipher suite incompatibility between Cloudflare and origin
Implementation References
| Language | Constant |
|---|---|
| Go | 525 (no standard constant) |
| Node.js | 525 (Cloudflare proprietary) |
| Python | response.status_code == 525 |
History
Part of Cloudflare's 520–527 proprietary range. 525 addresses the TLS-layer failure scenario – a gap between transport-level failures (522, 523) and application-level failures (520, 521).
Related Status Codes
Related Headers
FAQ
How do I fix a 525 SSL Handshake Failed error?
Debug in order: (1) Test the TLS handshake directly to your origin IP using openssl s_client. (2) Check certificate expiry – renew if expired. (3) Verify the certificate's CN/SAN includes the hostname Cloudflare is connecting with. (4) Check the origin supports TLS 1.2 or higher. (5) If using a self-signed certificate, issue a Cloudflare Origin CA certificate instead. (6) Temporarily switch Cloudflare SSL mode to 'Full' (not Strict) to isolate whether it's a certificate validity issue.
What is the difference between 525 and 526?
525 means the TLS handshake itself failed – the TLS negotiation couldn't complete. 526 means the TLS handshake succeeded but the certificate is invalid (self-signed, expired, or wrong hostname). In practice: 525 = can't complete the SSL connection, 526 = connected but the certificate isn't trusted.