Cloudflare Error 526 means your origin presented a certificate and Cloudflare refused to trust it. This only happens under SSL mode Full (Strict), which is the mode that actually validates — and that makes 526 the error you should want, because the alternative is trusting an unverified origin.
The four reasons a certificate gets rejected ¶
- It expired. The most common by far, and the most avoidable. Check it with our SSL certificate checker — against the origin hostname, since through the proxy you see Cloudflare's certificate instead.
- It is self-signed. Fine in development, untrusted in Full (Strict). Cloudflare issues free Origin Certificates specifically so you do not have to choose between self-signed and paying a CA.
- The hostname does not match. A certificate for
example.compresented forapi.example.comfails validation, as does a missing SAN entry on a multi-domain setup. - The chain is incomplete. The leaf certificate is valid but the intermediate is missing, so the path to a trusted root cannot be built. Browsers often paper over this by fetching intermediates; strict validators do not. This is the one that produces "it works in my browser but Cloudflare rejects it."
525 vs 526, precisely ¶
525 is a handshake that never completed — no agreement on protocol or cipher, or nothing listening on 443. 526 is a handshake that completed and produced a certificate Cloudflare then judged untrustworthy. In short: 525 is "we could not talk", 526 is "we talked and I do not believe you are who you claim."
Fixing it ¶
- Renew if expired. If you use Let's Encrypt, check that the renewal cron is actually running — a silently failing renewal is the usual root cause, and it fails 60 days before anyone notices.
- Install a full chain, not just the leaf. Most CAs provide a fullchain file for this reason; using the leaf-only file is the classic mistake.
- Match the hostname, including every subdomain you proxy, or use a wildcard.
- Use a Cloudflare Origin Certificate if the origin is only ever reached through Cloudflare. They are free, valid for years, and trusted by Cloudflare by definition.
Do not "fix" it by dropping to Full (non-strict). That silences the error by disabling the check, leaving you encrypted to an origin whose identity is unverified — which is most of the value of TLS gone.
Catching it before your visitors do ¶
Certificate expiry is entirely predictable, which makes it an unusually stupid way to go down. isitdown.io tracks certificate expiry on monitored sites and warns before the date rather than after, and the SSL checker answers the one-off question in a few seconds.
Why the renewal quietly failed ¶
When a 526 arrives from an expired certificate, the interesting question is not "how do I renew" but "why did the automation stop". The recurring causes are worth knowing because they all fail silently for weeks:
- The ACME challenge stopped working — an HTTP-01 challenge needs
/.well-known/acme-challenge/reachable on port 80, and a redirect-everything-to-HTTPS rule added later will break it. - The renewal cron was never running on this host, only on the one it was copied from.
- The certificate renewed but the service was never reloaded, so the process is still serving the old file from memory. This is the sneakiest: the file on disk is valid and the server is presenting an expired one.
That last case is worth checking explicitly, because looking at the certificate file will tell you everything is fine while Cloudflare continues to disagree.
FAQ ¶
Why does my browser accept the certificate but Cloudflare doesn't?
Usually a missing intermediate. Browsers frequently fetch the missing link automatically; Cloudflare's validation does not. Install the full chain and both are satisfied.
Is 526 safe to ignore by switching SSL mode?
It removes the message, not the problem. Full (non-strict) encrypts to your origin without verifying it, which defeats the point of the check. Fix the certificate.
How long does a fix take to show?
Usually immediately — Cloudflare revalidates on new connections. If it lingers, confirm you replaced the certificate the server is actually loading, and that the service was reloaded afterwards.