Cloudflare Error 526: Invalid SSL Certificate on the Origin, and How to Fix It

Cloudflare returns 526 "when these two conditions are true: Cloudflare cannot validate the SSL certificate at your origin web server" and the zone's encryption mode is Full (strict) (Cloudflare: Error 526). The visitor's connection to Cloudflare is fine; the problem is the certificate on the connection from Cloudflare to your server, which visitors never see directly.

Full (strict) requires an origin certificate that is unexpired, "issued by a publicly trusted certificate authority or Cloudflare's Origin CA", and that "contains a Common Name (CN) or Subject Alternative Name (SAN) that matches the requested or target hostname" (Full (strict) mode). Plain Full mode, by contrast, does not validate the origin certificate "in any way". So 526 never appears in Full mode; a broken handshake there gives 525 instead.

Cloudflare also lists two special contexts. With Cloudflare Gateway (Zero Trust), 526 means Gateway did not trust the destination's certificate or connection. And Workers subrequests to hostnames outside your zone that are not proxied by Cloudflare always use Full (strict), whatever the zone setting, so a Worker can get 526 from an origin that loads fine in the browser.

1. Look at the certificate the origin actually serves, with the right SNI, bypassing Cloudflare:

   openssl s_client -connect 203.0.113.10:443 -servername www.example.com -showcerts </dev/null 2>/dev/null \
     | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

   Check the dates, the issuer and that the SAN list contains the proxied hostname.
2. Check the chain and trust with verification on:

   openssl s_client -connect 203.0.113.10:443 -servername www.example.com -verify_return_error </dev/null 2>&1 | grep -E 'Verify return code|depth'

   Verify return code: 0 (ok) is what Cloudflare needs. A code such as 20 (unable to get local issuer certificate) points to a missing intermediate.
3. Renew or reissue for every proxied hostname, point the server at the full chain and reload: nginx -t && systemctl reload nginx.
4. Or install a Cloudflare Origin CA certificate. Cloudflare trusts it for proxied traffic, and it can be valid for many years. Browsers do not trust it, so use it only on hostnames that stay proxied.
5. If you must keep a self-signed or private CA certificate, upload the CA to the Custom Origin Trust Store so Cloudflare accepts it.
6. Temporary workaround: switch the zone to Full. It restores the site but stops Cloudflare from checking the origin, so a third party could impersonate it; revert once the certificate is fixed.

The Origin CA route removes renewals as a source of 526, but it ties the hostname to the proxy: if you switch a record to DNS-only, visitors immediately get browser certificate errors. A public certificate keeps both paths working at the cost of automated renewal, which is exactly the job that, when it fails silently, produces the expired-certificate variant of 526. Whichever you pick, monitor the origin certificate's expiry separately from the edge certificate, because Cloudflare renews only its own.

openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null 2>&1 | grep 'Verify return code'
# Verify return code: 0 (ok)
curl -s -o /dev/null -w '%{http_code}\n' https://www.example.com/
# 200

Run the first command for every proxied hostname. To check the origin certificate from outside your network, enter a DNS-only (grey-cloud) hostname of the origin into the SSL checker: for a proxied name it would show Cloudflare's edge certificate instead.

• Cloudflare 525 — the TLS handshake with the origin failed
• Cloudflare 521 — no HTTPS listener at all can look like this
• unable to get local issuer certificate — the missing-intermediate error
• NET::ERR_CERT_DATE_INVALID — an expired certificate seen by browsers
• How to rotate an SSL certificate — renewal without downtime