Cloudflare 526 Invalid SSL Certificate

What Cloudflare 526 means

In Full (strict) mode, Cloudflare checks the origin certificate. 526 means it is expired, self-signed, or doesn’t match the host name. A free Cloudflare Origin CA certificate or Let’s Encrypt fixes it.

526 isn’t defined in any HTTP standard. It is specific to Cloudflare, so other servers and proxies won’t use it.

How to fix error 526

• Check expiry with openssl s_client -connect origin-ip:443 -servername example.com | openssl x509 -noout -dates.

Retrying

Rarely. The server can’t handle this request, so retrying it unchanged is unlikely to help.

Example response

HTTP/1.1 526 Invalid SSL Certificate
Date: Wed, 21 Oct 2026 10:30:00 GMT
Server: cloudflare
CF-RAY: 8c2f6a1e3b9d4e21-FRA
Content-Type: text/html; charset=UTF-8

Related status codes

• 525 SSL Handshake Failed : The TLS handshake with the origin server failed.
• 520 Web Server Returned an Unknown Error : The origin server returned an empty, unknown or unexpected response.
• 502 Bad Gateway : A proxy or gateway got an invalid response from the upstream server.

Other 5xx status codes

500 Internal Server Error · 501 Not Implemented · 502 Bad Gateway · 503 Service Unavailable · 504 Gateway Timeout · 505 HTTP Version Not Supported · 507 Insufficient Storage · 508 Loop Detected · 511 Network Authentication Required · 520 Web Server Returned an Unknown Error · 521 Web Server Is Down · 522 Connection Timed Out · 523 Origin Is Unreachable · 524 A Timeout Occurred · 525 SSL Handshake Failed

See the full list of HTTP status codes.

Sources

• Cloudflare docs: 5xx errors

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions