526 Invalid SSL Certificate

The 526 Invalid SSL Certificate status code appears when Cloudflare or Cloud Foundry's Gorouter is unable to validate the SSL/TLS certificate presented by the origin server or backend application.

Table of Contents

Usage

Cloudflare is a content delivery network acting as a reverse proxy between clients and origin servers. The 526 error means the SSL/TLS handshake completed, but the origin server's certificate failed validation. This error appears when the Cloudflare SSL/TLS mode is set to Full (Strict), which requires a valid, trusted certificate on the origin.

Common causes include:

  • The origin server's SSL certificate has expired.
  • The certificate was issued by an untrusted or self-signed certificate authority.
  • The certificate's common name (CN) or Subject Alternative Name (SAN) does not match the origin hostname.
  • The certificate chain is incomplete (missing intermediate certificates).

Cloudflare Zero Trust Gateway returns its own 526 variant when a proxied origin presents an untrusted certificate. Documented triggers include an unknown certificate issuer, a certificate revoked through a certificate revocation list, an expired certificate anywhere in the chain, a common name mismatch with the requested hostname, and a common name containing invalid characters.

Cloud Foundry's Gorouter also returns 526 when backend SSL verification is enabled and the backend presents a certificate signed by an unknown authority. The Gorouter logs this as backend_invalid_tls_cert and retries up to three times before returning the error to the client.

Example

A client sends an HTTPS request through Cloudflare. Cloudflare connects to the origin and performs the SSL/TLS handshake, but the origin's certificate has expired, triggering a 526 error.

Request

GET /dashboard HTTP/1.1
Host: www.example.re
Accept: text/html

Response

HTTP/1.1 526 Invalid SSL Certificate
Date: Mon, 02 Mar 2026 10:45:00 GMT
Content-Type: text/html
Server: cloudflare
CF-RAY: 8a1b2c3d4e5f6-SIN

<html>
<head><title>526 Invalid SSL Certificate</title></head>
<body>
<h1>Error 526</h1>
<p>Invalid SSL certificate</p>
</body>
</html>

Telling 526 apart from 525

526 arises only under the Full (Strict) encryption mode. Full performs no certificate validation, so the same origin certificate producing 526 under Full (Strict) passes unnoticed under Full.

525 is the neighboring case, where the handshake never completed at all. Nothing listening on port 443, no certificate presented, absent SNI support, or no shared cipher all produce 525 instead, and 525 appears under both modes.

Switching to Full temporarily is therefore a diagnostic rather than a fix. An error clearing on the switch confirms a certificate validation problem and belongs here. An error persisting belongs with 525.

Validation requires the certificate to be unexpired and unrevoked, issued by a recognized authority rather than self-signed, carrying a matching name in the common name or subject alternative name field, and served with the full chain including intermediates. A certificate valid in a browser sometimes fails here, because browsers repair a missing intermediate by fetching the gap themselves and Cloudflare does not.

Three documented remedies exist. Installing a Cloudflare origin certificate satisfies validation directly. Uploading a signing authority to the custom origin trust store covers internal authorities, and requires Advanced Certificate Manager on the zone. Downgrading to Full stops the validation rather than satisfying the requirement, and removes the protection along with the error.

Workers behave differently. External subrequests from a Worker always validate at Full (Strict) strength regardless of the zone setting.

How to fix

A 526 only occurs when the Cloudflare SSL/TLS mode is set to Full (Strict). In this mode, Cloudflare validates the origin's certificate against its trust store.

Install a valid, trusted SSL certificate on the origin. The certificate must meet all of these conditions:

  • Not expired or revoked.
  • Signed by a trusted certificate authority (not self-signed, unless added to the Custom Origin Trust Store).
  • Includes the requested hostname in the Common Name (CN) or Subject Alternative Name (SAN) field.
  • Served with all required intermediate certificates alongside the leaf, so Cloudflare can build a trusted chain to a root CA.

Generate a free Cloudflare Origin CA certificate in the dashboard under SSL/TLS > Origin Server > Create Certificate. This certificate is trusted by Cloudflare for up to 15 years and eliminates third-party CA dependency for the origin connection.

For self-signed certificates, add the certificate to the Custom Origin Trust Store in the Cloudflare dashboard. This tells Cloudflare to trust the specific self-signed certificate during validation.

Temporarily pause Cloudflare and run the SSL Shopper SSL Checker or openssl s_client -connect origin:443 to inspect the certificate chain the origin presents. Missing intermediate certificates are a common cause of chain validation failures.

As a quick workaround, switch the SSL/TLS mode from Full (Strict) to Full. This skips certificate validation entirely but reduces security. Use this only as a temporary measure while fixing the origin certificate.

See also

Last updated: August 17, 2026