Invalid SSL Certificate
ActiveHTTP 526 Invalid SSL Certificate is a Cloudflare-specific status meaning the TLS handshake with the origin succeeded, but the certificate presented by the origin is invalid – self-signed, expired, or for the wrong hostname – and Cloudflare is configured in Full (Strict) SSL mode. Unlike 525 (handshake failed), 526 means the connection established but the cert didn't pass validation.
Description
526 is the TLS certificate validation failure that follows a successful handshake (distinguishing it from 525 where the handshake itself fails). In Full (Strict) mode, Cloudflare validates the origin certificate against a trusted CA store. If the certificate is self-signed, expired, has a wrong Common Name, or is issued by an untrusted CA, Cloudflare returns 526. The fix is to install a valid certificate from a trusted CA or use a Cloudflare Origin CA certificate.
Examples
# Test origin certificate directly (bypassing Cloudflare)
openssl s_client -connect YOUR_ORIGIN_IP:443 -servername example.com 2>&1 | grep -E 'Verify|subject|notAfter'
# Expected output for a valid cert:
# subject=CN = example.com
# notAfter=Jan 01 00:00:00 2026 GMT
# Verify return code: 0 (ok)
# Output for invalid cert:
# Verify return code: 18 (self signed certificate)
# Verify return code: 10 (certificate has expired)# Generate Cloudflare Origin CA cert in Cloudflare dashboard:
# SSL/TLS → Origin Server → Create Certificate
# Install the generated cert + key on your origin server
# Cloudflare Origin CA is trusted by Cloudflare but NOT by browsers directly
# This is only valid when traffic reaches origin through CloudflareEdge Cases
- •Cloudflare Origin CA certificates are only trusted by Cloudflare – they will produce certificate errors if accessed directly (bypassing Cloudflare). This is intentional: they secure the Cloudflare-to-origin leg only.
- •In Full mode (not Strict), Cloudflare accepts self-signed certificates and won't produce a 526. Use Full Strict for proper validation.
- •Let's Encrypt certificates auto-renew every 90 days. If Certbot's renewal cron fails, the cert expires and causes 526.
- •Wildcard certificates (*.example.com) don't cover the apex domain (example.com) – if your origin uses a wildcard cert and Cloudflare connects to the apex, you may get a 526.
When You'll See This
- →Origin has a self-signed certificate and Cloudflare is in Full (Strict) mode
- →Origin SSL certificate expired
- →Certificate CN/SAN doesn't match the origin hostname Cloudflare connects to
- →Certificate issued by an untrusted or private CA
- →Let's Encrypt auto-renewal failed – certificate expired silently
Implementation References
| Language | Constant |
|---|---|
| Go | 526 (no standard constant) |
| Node.js | 526 (Cloudflare proprietary) |
| Python | response.status_code == 526 |
History
Part of Cloudflare's 520–527 range. 526 distinguishes certificate validation failure from handshake failure (525), providing more precise diagnosis.
Related Status Codes
Related Headers
FAQ
What is the difference between 525 and 526?
525 means the TLS handshake itself failed – the connection couldn't establish SSL/TLS at all (cipher mismatch, protocol version issue, SNI problem). 526 means the TLS handshake succeeded and a certificate was presented, but the certificate failed validation – it was self-signed, expired, or the hostname didn't match. Fix 525 by checking TLS configuration. Fix 526 by replacing the certificate with a valid one.
How do I fix a 526 without a paid CA certificate?
Use a Cloudflare Origin CA certificate (free, available in Cloudflare dashboard → SSL/TLS → Origin Server). It's issued by Cloudflare's own CA and trusted by Cloudflare in Full Strict mode. For public-facing origins, Let's Encrypt provides free certificates trusted by all browsers.