Platforms and DevOps
Cloudflare Error 526: invalid SSL certificate on the origin
Error 526: invalid SSL certificateCloudflare Error 526 means Cloudflare could not validate the certificate your origin server presented. The handshake completed, but Full (strict) mode checks the origin certificate the way a browser would, and the check failed. The usual reasons are an expired or self-signed certificate, a certificate for another hostname, or a missing intermediate.
What Full (strict) checks
According to Cloudflare's documentation, the origin certificate must meet all of these conditions:
| Check | Fails when |
|---|---|
| Not expired | notAfter is in the past, typically after a failed renewal |
| Not revoked | The CA revoked the certificate |
| Signed by a CA | It is self-signed (unless added to the Custom Origin Trust Store) |
| Hostname matches | The requested hostname is not in the Common Name or Subject Alternative Name |
| Complete chain | The origin sends only the leaf, not the intermediates |
Publicly trusted certificates and Cloudflare Origin CA certificates both pass the CA check. Full mode, by contrast, accepts any certificate, which is why the same origin can work in Full and fail in Full (strict).
When 526 usually appears
The timing of the first 526 is often the quickest clue:
- Right after switching the zone to Full (strict). The origin certificate was never valid; Full mode did not check it. Look at causes 2 to 4.
- On a date nobody touched anything. The origin certificate reached its
notAfterdate. Look at cause 1. - After moving to a new server or hosting panel. The new machine is serving a self-signed placeholder or a certificate without the intermediates.
- After adding a new proxied subdomain. The existing origin certificate does not list the new name.
- Only on some requests. One of several origins behind a load balancer or DNS round-robin has an outdated certificate. Test each origin IP separately.
Common causes, most frequent first
1. The origin certificate expired
A renewal job stopped working months ago and nobody noticed. Let's Encrypt stopped sending expiry reminder emails on 2025-06-04, and Cloudflare does not send expiration notifications for Origin CA certificates, so the 526 is often the first alert. Confirm by connecting to the origin IP directly:
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -subject -dates
2. Self-signed or private-CA certificate
Many hosting panels install a self-signed placeholder certificate on port 443. It is fine for Full mode but not for Full (strict). The subject and issuer printed by openssl x509 -noout -subject -issuer are identical for a self-signed certificate.
3. Hostname not covered
The certificate covers example.com but the proxied record is www.example.com or api.example.com, or the origin presents its default certificate because its SNI configuration does not know the name Cloudflare sends. List the names:
openssl s_client -connect 203.0.113.10:443 -servername www.example.com </dev/null 2>/dev/null \
| openssl x509 -noout -ext subjectAltName
4. Missing intermediate certificate
The server is configured with cert.pem instead of fullchain.pem. Count the certificates the origin sends:
openssl s_client -connect 203.0.113.10:443 -servername example.com -showcerts </dev/null 2>/dev/null \
| grep -c 'BEGIN CERTIFICATE'
One certificate from a public CA almost always means the chain is incomplete. See missing intermediate certificate.
5. Revoked certificate
This is less common; it happens after a key compromise report or a CA mass revocation. The CA's notification and the certificate's CRL entry confirm it.
How to fix it
Renew or replace the certificate. On a server using Certbot:
sudo certbot renew --cert-name example.com
sudo systemctl reload nginx
Serve the full chain. In Nginx, ssl_certificate must point to the leaf followed by the intermediates (fullchain.pem). In Apache 2.4.8 and later, put the chain in the file named by SSLCertificateFile. In IIS, import the intermediate into the Intermediate Certification Authorities store.
Cover every proxied hostname. Reissue with all names, for example certbot -d example.com -d www.example.com, or use a wildcard from DNS validation.
Use a Cloudflare Origin CA certificate if visitors never reach the origin directly. It covers the apex and first-level wildcard by default and is accepted by Full (strict). The step-by-step is in the Cloudflare origin certificate guide.
Keep a self-signed certificate only if you add it to Cloudflare's Custom Origin Trust Store.
Automate renewal. Certificate lifetimes for public TLS certificates were capped at 200 days on 2026-03-15 and drop to 100 days on 2027-03-15; Let's Encrypt's tlsserver profile already issues 45-day certificates. Use automatic renewal with a reload hook.
How to verify the fix
- Validate the origin the way Cloudflare does, from outside Cloudflare, by pinning the hostname to the origin IP:
bash
curl -sv --resolve example.com:443:203.0.113.10 https://example.com/ -o /dev/null 2>&1 \
| grep -E 'expire date|subjectAltName|SSL certificate verify'
SSL certificate verify ok means a public CA certificate is valid and complete. An Origin CA certificate fails this test by design because it is not publicly trusted; check its dates and names instead.
2. Load the site through Cloudflare and confirm the 526 page is gone.
3. Use the chain builder to check chain order, and the SSL checker for the certificate visitors see at the edge.
FAQ
Is it safe to switch from Full (strict) to Full to make 526 go away?
It restores the site, but Cloudflare's documentation states that in Full mode the origin certificate "will not be validated in any way": it can be expired, self-signed or for another hostname. Anyone able to intercept traffic between Cloudflare and your origin could then impersonate the origin. Treat Full as a temporary measure and switch back once the certificate is fixed.
My browser shows the origin certificate is fine. Why does Cloudflare still return 526?
Browsers repair incomplete chains by fetching missing intermediates or using cached ones, and they never see the origin certificate when the site is proxied. Cloudflare requires the origin to send the leaf and intermediates itself. Test the origin directly with openssl s_client -showcerts and count the certificates it returns.
Can I use a Cloudflare Origin CA certificate with Full (strict)?
Yes. Cloudflare lists Origin CA certificates as an accepted option for Full (strict). They are trusted only by Cloudflare, so they fail if you later turn off the proxy (grey cloud) or let visitors reach the origin directly. See the Origin CA guide.
How do I stop 526 from coming back after renewals?
Automate renewal with an ACME client, make the renewal hook reload the web server, and monitor the origin certificate's expiry yourself. With certificate lifetimes capped at 200 days since 2026-03-15 and 100 days from 2027-03-15, manual renewal becomes a regular source of 526 errors.