Cloudflare Error 525 means the TCP connection to your origin succeeded and the TLS handshake on top of it failed. The network is fine; the encryption negotiation is not. That narrows the problem to three things: the certificate, the protocol versions, or the cipher suites.
What has to be true for a handshake to succeed ¶
When Cloudflare connects to your origin over HTTPS, both sides must agree on a TLS version and a cipher suite, and your origin must present a certificate Cloudflare will accept for that hostname. A 525 means one of those failed — and because the handshake aborts before any HTTP is exchanged, there is no status code from your server to inspect.
The causes, in order ¶
- No certificate on the origin at all. Extremely common when SSL mode is set to Full or Full (Strict) but the origin only ever served plain HTTP. Cloudflare tries HTTPS to port 443, finds nothing listening or nothing valid, and 525s.
- An expired origin certificate. Under Full (Strict), Cloudflare validates it. Check the expiry with our SSL checker — and note that it must be checked against the origin, since through the proxy you will see Cloudflare's certificate, not yours.
- Protocol mismatch. An origin locked to TLS 1.0/1.1 that Cloudflare will no longer negotiate, or one requiring a version the connection cannot agree on.
- No shared cipher suite — an origin hardened to an unusual set that excludes everything Cloudflare offers.
- SNI problems where the origin serves multiple sites and does not present the right certificate for the hostname requested.
525 vs 526 ¶
They are neighbours and often confused. 525 is a handshake that failed — the parties could not establish an encrypted channel. 526 is a handshake that completed with a certificate Cloudflare then judged invalid: expired, self-signed, wrong hostname, or from an untrusted issuer. If you see 526, the crypto works and the identity is wrong; if you see 525, the crypto itself did not come together.
The fastest fix path ¶
- Check your Cloudflare SSL mode. If the origin has no certificate, Full and Full (Strict) cannot work. Either install a certificate (Cloudflare issues free Origin Certificates for exactly this) or, as a temporary measure, drop to Flexible — understanding that Flexible leaves the Cloudflare-to-origin leg unencrypted, which is not somewhere to stay.
- Verify the certificate on the origin directly, not through the proxy.
- Confirm port 443 is open to Cloudflare's IP ranges. A firewall that permits 80 and not 443 produces this precisely.
- Check TLS versions your origin accepts; TLS 1.2 as a minimum is the safe modern baseline.
Catching it before visitors do ¶
Handshake failures are almost always introduced by a change: a certificate renewal that swapped in the wrong file, a hardening pass that removed a cipher, an SSL-mode switch made while debugging something else. None of those announce themselves, and all of them are silent until the next visitor arrives.
Monitoring the origin hostname directly — not the proxied one — is what catches this class early, because through Cloudflare you only ever see Cloudflare's own certificate. Our SSL checker answers the question for a single host, and a monitor on the origin surfaces the failure at the moment it appears rather than at the moment someone complains.
FAQ ¶
Can I fix 525 by switching to Flexible SSL?
It will usually make the error disappear, because Cloudflare stops attempting HTTPS to your origin. It also means traffic between Cloudflare and your server travels unencrypted across the public internet. Use it to confirm the diagnosis, then install a certificate and go back to Full (Strict).
Why does my site show a valid certificate in the browser but still 525?
Because the certificate your browser sees is Cloudflare's, presented at the edge. The origin certificate is a separate thing behind it, and that is the one failing.
Is 525 an outage?
For visitors, yes — the page does not load. But the server is running; only the encrypted link to it is broken, which is usually faster to fix than a genuine outage.