HTTP 525 — SSL Handshake Failed
HTTP 525
SSL Handshake Failed
The TLS handshake between Cloudflare and the origin server failed.
What 525 actually means
A Cloudflare code rather than a standard one. Cloudflare reached the origin over port 443 but could not complete a TLS handshake with it — no shared cipher, no certificate presented, or an origin not actually speaking TLS on that port. It very often appears immediately after switching Cloudflare's SSL mode to Full or Full (strict) on an origin that was only ever configured for plain HTTP.
Common causes
- Cloudflare SSL mode set to Full or Full (strict) while the origin has no TLS configured
- No valid certificate installed at the origin
- The origin and Cloudflare sharing no common cipher suite or TLS version
- SNI misconfiguration at the origin, so it presents the wrong certificate or none
- A firewall interfering with port 443 traffic from Cloudflare
If you're just trying to view the page
- Nothing — this is a configuration problem between Cloudflare and the site's server
- Report it to the site owner with the Ray ID; it is usually a quick fix on their end
If it's your site
- Install a valid certificate at the origin — a free Cloudflare Origin CA certificate is designed exactly for this
- Check Cloudflare's SSL/TLS encryption mode matches what the origin can actually do
- Test the handshake directly: `openssl s_client -connect origin:443 -servername example.com`
- Verify the origin supports a modern TLS version and cipher suite Cloudflare will negotiate
- Make sure the origin serves the right certificate for the SNI hostname Cloudflare sends
Reference
- Status code
- 525
- Reason phrase
- SSL Handshake Failed
- Category
- 5xx — Server Error
- Cacheable by default
- No
Common questions
- What does HTTP 525 mean?
- The TLS handshake between Cloudflare and the origin server failed. A Cloudflare code rather than a standard one. Cloudflare reached the origin over port 443 but could not complete a TLS handshake with it — no shared cipher, no certificate presented, or an origin not actually speaking TLS on that port.
- How do I fix a 525 error?
- Nothing — this is a configuration problem between Cloudflare and the site's server
- Is 525 a client error or a server error?
- 525 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.
Related pages
- 500 Internal Server Error Something went wrong on the server and it has no more specific code to describe
- 502 Bad Gateway A proxy or gateway reached the server behind it and got back a broken response,
- 503 Service Unavailable The server is temporarily unable to handle the request, usually because it is ov
- 504 Gateway Timeout A proxy or gateway waited for the server behind it and gave up before an answer
- 524 A Timeout Occurred Cloudflare connected to the origin successfully but the origin did not finish re
- 521 Web Server Is Down Cloudflare could not connect to the origin server because it refused the connect
- 522 Connection Timed Out Cloudflare tried to open a connection to the origin server and never got a reply
- 520 Web Server Returned an Unknown Error Cloudflare reached the origin server but got back a response it could not make s
- 526 Invalid SSL Certificate The origin server presented a TLS certificate that Cloudflare could not validate
- 530 Origin DNS Error A Cloudflare error shown alongside a 1xxx error code that carries the real expla
- 501 Not Implemented The server does not support the functionality needed to fulfil the request, usua
- 511 Network Authentication Required You need to log in to the network itself — this is a captive portal, not the sit