---
title: "525 SSL Handshake Failed — what it means and how to fix it"
description: "The TLS handshake between Cloudflare and the origin server failed. What causes an HTTP 525, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/525/
site: "At One Place"
---

# HTTP 525 — SSL Handshake Failed

**HTTP 525: SSL Handshake Failed**

The TLS handshake between Cloudflare and the origin server failed.

## What 525 actually means

A Cloudflare code rather than a standard one. Cloudflare reached the origin over port 443 but could not complete a TLS handshake with it — no shared cipher, no certificate presented, or an origin not actually speaking TLS on that port. It very often appears immediately after switching Cloudflare's SSL mode to Full or Full (strict) on an origin that was only ever configured for plain HTTP.

## Common causes

- Cloudflare SSL mode set to Full or Full (strict) while the origin has no TLS configured
- No valid certificate installed at the origin
- The origin and Cloudflare sharing no common cipher suite or TLS version
- SNI misconfiguration at the origin, so it presents the wrong certificate or none
- A firewall interfering with port 443 traffic from Cloudflare

## If you're just trying to view the page

1. Nothing — this is a configuration problem between Cloudflare and the site's server
2. Report it to the site owner with the Ray ID; it is usually a quick fix on their end

## If it's your site

1. Install a valid certificate at the origin — a free Cloudflare Origin CA certificate is designed exactly for this
2. Check Cloudflare's SSL/TLS encryption mode matches what the origin can actually do
3. Test the handshake directly: `openssl s_client -connect origin:443 -servername example.com`
4. Verify the origin supports a modern TLS version and cipher suite Cloudflare will negotiate
5. Make sure the origin serves the right certificate for the SNI hostname Cloudflare sends

## Reference

- **Status code:** 525
- **Reason phrase:** SSL Handshake Failed
- **Category:** 5xx — Server Error
- **Cacheable by default:** No

## Common questions

### What does HTTP 525 mean?

The TLS handshake between Cloudflare and the origin server failed. A Cloudflare code rather than a standard one. Cloudflare reached the origin over port 443 but could not complete a TLS handshake with it — no shared cipher, no certificate presented, or an origin not actually speaking TLS on that port.

### How do I fix a 525 error?

Nothing — this is a configuration problem between Cloudflare and the site's server

### Is 525 a client error or a server error?

525 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.

## Related pages

- [500 Internal Server Error](https://atoneplace.net/error/500/)
- [502 Bad Gateway](https://atoneplace.net/error/502/)
- [503 Service Unavailable](https://atoneplace.net/error/503/)
- [504 Gateway Timeout](https://atoneplace.net/error/504/)
- [524 A Timeout Occurred](https://atoneplace.net/error/524/)
- [521 Web Server Is Down](https://atoneplace.net/error/521/)
- [522 Connection Timed Out](https://atoneplace.net/error/522/)
- [520 Web Server Returned an Unknown Error](https://atoneplace.net/error/520/)
- [526 Invalid SSL Certificate](https://atoneplace.net/error/526/)
- [530 Origin DNS Error](https://atoneplace.net/error/530/)
- [501 Not Implemented](https://atoneplace.net/error/501/)
- [511 Network Authentication Required](https://atoneplace.net/error/511/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)