At One Place

HTTP 525 — SSL Handshake Failed

HTTP 525
SSL Handshake Failed
The TLS handshake between Cloudflare and the origin server failed.

What 525 actually means

A Cloudflare code rather than a standard one. Cloudflare reached the origin over port 443 but could not complete a TLS handshake with it — no shared cipher, no certificate presented, or an origin not actually speaking TLS on that port. It very often appears immediately after switching Cloudflare's SSL mode to Full or Full (strict) on an origin that was only ever configured for plain HTTP.

Common causes

  • Cloudflare SSL mode set to Full or Full (strict) while the origin has no TLS configured
  • No valid certificate installed at the origin
  • The origin and Cloudflare sharing no common cipher suite or TLS version
  • SNI misconfiguration at the origin, so it presents the wrong certificate or none
  • A firewall interfering with port 443 traffic from Cloudflare

If you're just trying to view the page

  1. Nothing — this is a configuration problem between Cloudflare and the site's server
  2. Report it to the site owner with the Ray ID; it is usually a quick fix on their end

If it's your site

  1. Install a valid certificate at the origin — a free Cloudflare Origin CA certificate is designed exactly for this
  2. Check Cloudflare's SSL/TLS encryption mode matches what the origin can actually do
  3. Test the handshake directly: `openssl s_client -connect origin:443 -servername example.com`
  4. Verify the origin supports a modern TLS version and cipher suite Cloudflare will negotiate
  5. Make sure the origin serves the right certificate for the SNI hostname Cloudflare sends

Reference

Status code
525
Reason phrase
SSL Handshake Failed
Category
5xx — Server Error
Cacheable by default
No

Common questions

What does HTTP 525 mean?
The TLS handshake between Cloudflare and the origin server failed. A Cloudflare code rather than a standard one. Cloudflare reached the origin over port 443 but could not complete a TLS handshake with it — no shared cipher, no certificate presented, or an origin not actually speaking TLS on that port.
How do I fix a 525 error?
Nothing — this is a configuration problem between Cloudflare and the site's server
Is 525 a client error or a server error?
525 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.

Related pages

Sources

  1. Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA
  2. RFC 9110: HTTP Semantics — IETF

How these figures are compiled and checked