---
title: "526 Invalid SSL Certificate — what it means and how to fix it"
description: "The origin server presented a TLS certificate that Cloudflare could not validate. What causes an HTTP 526, what to try as a visitor, and what to check if it is your own site."
url: https://atoneplace.net/error/526/
site: "At One Place"
---

# HTTP 526 — Invalid SSL Certificate

**HTTP 526: Invalid SSL Certificate**

The origin server presented a TLS certificate that Cloudflare could not validate.

## What 526 actually means

Cloudflare-specific, and closely related to 525 — the handshake got far enough for a certificate to be presented, and the certificate failed validation. It only occurs when the SSL mode is Full (strict), which is the mode that actually checks the origin certificate. Expired certificates and self-signed certificates are the two dominant causes.

## Common causes

- The origin certificate has expired
- A self-signed certificate with SSL mode set to Full (strict)
- A certificate whose name does not match the hostname
- A missing intermediate certificate, so the chain does not validate
- A certificate issued by a CA Cloudflare does not trust

## If you're just trying to view the page

1. Nothing on your side — the site's origin certificate needs renewing or replacing
2. Report it to the site owner with the Ray ID; expired certificates are a common and quick fix

## If it's your site

1. Check the certificate's expiry and renew it; automate renewal so it does not recur
2. Install a Cloudflare Origin CA certificate, which is free, long-lived and trusted by Cloudflare in strict mode
3. Include the full chain, not just the leaf — a missing intermediate is a very common cause
4. If the certificate genuinely cannot be made valid, switch the SSL mode to Full (non-strict) as a temporary measure, understanding that it stops verifying the origin

## Reference

- **Status code:** 526
- **Reason phrase:** Invalid SSL Certificate
- **Category:** 5xx — Server Error
- **Cacheable by default:** No

## Common questions

### What does HTTP 526 mean?

The origin server presented a TLS certificate that Cloudflare could not validate. Cloudflare-specific, and closely related to 525 — the handshake got far enough for a certificate to be presented, and the certificate failed validation. It only occurs when the SSL mode is Full (strict), which is the mode that actually checks the origin certificate.

### How do I fix a 526 error?

Nothing on your side — the site's origin certificate needs renewing or replacing

### Is 526 a client error or a server error?

526 is in the 5xx range, which means server error. The request was acceptable but the server could not fulfil it, so retrying later can succeed.

## Related pages

- [500 Internal Server Error](https://atoneplace.net/error/500/)
- [502 Bad Gateway](https://atoneplace.net/error/502/)
- [503 Service Unavailable](https://atoneplace.net/error/503/)
- [504 Gateway Timeout](https://atoneplace.net/error/504/)
- [524 A Timeout Occurred](https://atoneplace.net/error/524/)
- [521 Web Server Is Down](https://atoneplace.net/error/521/)
- [522 Connection Timed Out](https://atoneplace.net/error/522/)
- [520 Web Server Returned an Unknown Error](https://atoneplace.net/error/520/)
- [525 SSL Handshake Failed](https://atoneplace.net/error/525/)
- [530 Origin DNS Error](https://atoneplace.net/error/530/)
- [501 Not Implemented](https://atoneplace.net/error/501/)
- [511 Network Authentication Required](https://atoneplace.net/error/511/)

## Sources

- Hypertext Transfer Protocol (HTTP) Status Code Registry — IANA (https://www.iana.org/assignments/http-status-codes/)
- RFC 9110: HTTP Semantics — IETF (https://www.rfc-editor.org/rfc/rfc9110.html)