HTTP 526 — Invalid SSL Certificate
HTTP 526
Invalid SSL Certificate
The origin server presented a TLS certificate that Cloudflare could not validate.
What 526 actually means
Cloudflare-specific, and closely related to 525 — the handshake got far enough for a certificate to be presented, and the certificate failed validation. It only occurs when the SSL mode is Full (strict), which is the mode that actually checks the origin certificate. Expired certificates and self-signed certificates are the two dominant causes.
Common causes
- The origin certificate has expired
- A self-signed certificate with SSL mode set to Full (strict)
- A certificate whose name does not match the hostname
- A missing intermediate certificate, so the chain does not validate
- A certificate issued by a CA Cloudflare does not trust
If you're just trying to view the page
- Nothing on your side — the site's origin certificate needs renewing or replacing
- Report it to the site owner with the Ray ID; expired certificates are a common and quick fix
If it's your site
- Check the certificate's expiry and renew it; automate renewal so it does not recur
- Install a Cloudflare Origin CA certificate, which is free, long-lived and trusted by Cloudflare in strict mode
- Include the full chain, not just the leaf — a missing intermediate is a very common cause
- If the certificate genuinely cannot be made valid, switch the SSL mode to Full (non-strict) as a temporary measure, understanding that it stops verifying the origin
Reference
- Status code
- 526
- Reason phrase
- Invalid SSL Certificate
- Category
- 5xx — Server Error
- Cacheable by default
- No
Common questions
- What does HTTP 526 mean?
- The origin server presented a TLS certificate that Cloudflare could not validate. Cloudflare-specific, and closely related to 525 — the handshake got far enough for a certificate to be presented, and the certificate failed validation. It only occurs when the SSL mode is Full (strict), which is the mode that actually checks the origin certificate.
- How do I fix a 526 error?
- Nothing on your side — the site's origin certificate needs renewing or replacing
- Is 526 a client error or a server error?
- 526 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.
Related pages
- 500 Internal Server Error Something went wrong on the server and it has no more specific code to describe
- 502 Bad Gateway A proxy or gateway reached the server behind it and got back a broken response,
- 503 Service Unavailable The server is temporarily unable to handle the request, usually because it is ov
- 504 Gateway Timeout A proxy or gateway waited for the server behind it and gave up before an answer
- 524 A Timeout Occurred Cloudflare connected to the origin successfully but the origin did not finish re
- 521 Web Server Is Down Cloudflare could not connect to the origin server because it refused the connect
- 522 Connection Timed Out Cloudflare tried to open a connection to the origin server and never got a reply
- 520 Web Server Returned an Unknown Error Cloudflare reached the origin server but got back a response it could not make s
- 525 SSL Handshake Failed The TLS handshake between Cloudflare and the origin server failed.
- 530 Origin DNS Error A Cloudflare error shown alongside a 1xxx error code that carries the real expla
- 501 Not Implemented The server does not support the functionality needed to fulfil the request, usua
- 511 Network Authentication Required You need to log in to the network itself — this is a captive portal, not the sit