Cloudflare Errors

Cloudflare error 526

Advanced Risk: medium

Last reviewed August 8, 2026

Hosting access may not be needed Database access usually not needed

Direct answer

526

Cloudflare Error 526 means Full (strict) SSL/TLS mode is on and Cloudflare cannot validate the certificate on your origin—renew or replace that origin certificate (correct name, unexpired, complete chain, or Cloudflare Origin CA) instead of leaving Flexible SSL as a permanent workaround.

526 is an origin certificate validation failure on the Cloudflare-to-host HTTPS leg under Full (strict), not a visitor-browser padlock warning by itself. This guide separates 526 from handshake-failure 525, shows how to verify the origin cert directly, and covers Let’s Encrypt, host AutoSSL, and Origin CA repairs that restore Full (strict) safely.

Advanced

Key facts

Verifiable numbers and definitions — each claim links to its source.

Error 526 indicates Cloudflare cannot verify the SSL certificate on the origin when Full (strict) SSL is enabled. (Cloudflare Error 526)
Full (strict) requires a valid origin certificate that matches the hostname Cloudflare is requesting. (Full (strict) encryption mode)
Let’s Encrypt provides free certificates that can be automated on many hosting platforms for HTTPS origins. (Let's Encrypt Getting Started)

What the error means

When a hostname is proxied and Cloudflare SSL/TLS encryption mode is Full (strict), Cloudflare connects to your origin over HTTPS and requires a certificate it can validate. Error 526 means that validation failed—common reasons include an expired or revoked certificate, a self-signed cert not trusted by Cloudflare, a hostname missing from the certificate SAN/CN, or an incomplete chain. That differs from 525, where the TLS handshake itself fails, and from Flexible mode, where Cloudflare does not use HTTPS to the origin at all. Visitors already reached Cloudflare; the edge refused to complete a trusted HTTPS hop to your host.

Common symptoms

Visitors see Cloudflare’s “Error 526: Invalid SSL certificate” page with a Ray ID
SSL/TLS mode in Cloudflare is Full (strict)
Direct HTTPS to the origin shows expired, name-mismatch, self-signed, or chain errors
Problem started after certificate expiry, AutoSSL/Let’s Encrypt failure, or enabling Full (strict)
Switching temporarily to Full (not strict) makes the site load while Strict still 526s
Hosting panel shows SSL not installed, expired, or pending for the exact hostname
Only some hostnames fail when one subdomain lacks a matching certificate SAN

Most likely causes

01 Origin certificate expired or was revoked
02 Self-signed or privately signed certificate not trusted under Full (strict)
03 Certificate CN/SAN does not include the hostname Cloudflare is requesting
04 Incomplete certificate chain (missing intermediates) on the origin listener
05 Recent move to Full (strict) while the origin still has a weak or placeholder cert
06 Wrong certificate bound on a multi-domain vhost / missing SNI name
07 Let’s Encrypt or AutoSSL renewal failed silently after a DNS or HTTP-01 challenge break

What changed before the problem started

Cloudflare SSL/TLS mode raised to Full (strict)
Origin certificate expired or failed renewal (Let’s Encrypt/AutoSSL)
Manual certificate install that omitted intermediates or used the wrong private key
Hostname or subdomain added without updating the certificate SANs
Hosting migration left HTTPS using a temporary self-signed cert
SNI/vhost TLS binding broken after domain or panel changes

Troubleshooting steps

01
Confirm 526 and note Full (strict) mode
Read the Cloudflare error page for 526 and open SSL/TLS → Overview. 526 is expected specifically when Strict validation cannot accept the origin certificate. Capture the Ray ID and hostname before changing modes.
02
Test the origin certificate with Cloudflare bypassed
Grey-cloud briefly or curl the origin IP with SNI/Host set to your domain on port 443. Note expiry, SAN coverage, self-signed warnings, and chain errors. If direct HTTPS already fails validation, fix the host certificate first—Cloudflare Strict is correctly rejecting it.
03
Renew or reinstall a valid origin certificate
In cPanel, Plesk, or the host SSL panel, renew Let’s Encrypt/AutoSSL or install a certificate that covers the exact hostname. Confirm the full chain is installed, not only the leaf. Retest direct :443 before returning to Strict.
04
Use Full only as a short diagnostic, not a permanent fix
Moving from Full (strict) to Full can stop 526 by skipping origin cert validation, but it weakens the guarantee that you are talking to the intended origin. Prefer repairing the certificate and restoring Full (strict).
05
Consider a Cloudflare Origin CA certificate when public issuance is awkward
If the origin only receives Cloudflare traffic, generate an Origin CA certificate in the Cloudflare dashboard, install it on the host, keep port 443 open, and run Full (strict). That encrypts and validates the proxy-to-origin leg without relying on public CA renewal at the host.
06
Send Ray ID, mode, and cert details to the host if panel renewal fails
Provide the Ray ID, SSL/TLS mode, openssl/curl cert output, and panel SSL errors. Hosts can repair AutoSSL challenges, chain installs, and vhost bindings faster with that package than with “site down” alone.

Confirm 526 and note Full (strict) mode

Read the Cloudflare error page for 526 and open SSL/TLS → Overview. 526 is expected specifically when Strict validation cannot accept the origin certificate. Capture the Ray ID and hostname before changing modes.

Test the origin certificate with Cloudflare bypassed

Grey-cloud briefly or curl the origin IP with SNI/Host set to your domain on port 443. Note expiry, SAN coverage, self-signed warnings, and chain errors. If direct HTTPS already fails validation, fix the host certificate first—Cloudflare Strict is correctly rejecting it.

Renew or reinstall a valid origin certificate

In cPanel, Plesk, or the host SSL panel, renew Let’s Encrypt/AutoSSL or install a certificate that covers the exact hostname. Confirm the full chain is installed, not only the leaf. Retest direct :443 before returning to Strict.

Use Full only as a short diagnostic, not a permanent fix

Moving from Full (strict) to Full can stop 526 by skipping origin cert validation, but it weakens the guarantee that you are talking to the intended origin. Prefer repairing the certificate and restoring Full (strict).

Consider a Cloudflare Origin CA certificate when public issuance is awkward

If the origin only receives Cloudflare traffic, generate an Origin CA certificate in the Cloudflare dashboard, install it on the host, keep port 443 open, and run Full (strict). That encrypts and validates the proxy-to-origin leg without relying on public CA renewal at the host.

Send Ray ID, mode, and cert details to the host if panel renewal fails

Provide the Ray ID, SSL/TLS mode, openssl/curl cert output, and panel SSL errors. Hosts can repair AutoSSL challenges, chain installs, and vhost bindings faster with that package than with “site down” alone.

When to stop troubleshooting

Escalate when you cannot install or renew certificates, Full (strict) was mandated without a usable origin cert, panel AutoSSL keeps failing, or checkout stays down during business hours. Provide the Ray ID, SSL/TLS mode, direct :443 certificate output, and panel SSL status—do not leave Flexible on permanently just to hide 526.

Information to collect before requesting help

01 Cloudflare Ray ID from the 526 page
02 Current Cloudflare SSL/TLS encryption mode
03 Whether direct HTTPS to the origin on port 443 shows cert errors
04 Certificate issuer, hostnames covered, expiry, and chain status on the origin
05 Hosting provider and AutoSSL/Let’s Encrypt error messages
06 Recent SSL mode changes, migrations, or certificate reinstalls
07 Screenshot of SSL/TLS Overview and the 526 error page

How a professional repairs the problem

We verify 526 under Full (strict), test origin HTTPS independently of the proxy, and restore a valid origin certificate—public CA/Let’s Encrypt or Cloudflare Origin CA—with correct SANs and a complete chain. We return the zone to Full (strict), keep Flexible out of the permanent design, and confirm proxied HTTPS loads without padlock or edge errors before closing.

Frequently asked questions

Is Error 526 a problem with my visitors’ browsers? +

No. 526 is Cloudflare rejecting the origin certificate on the edge-to-host leg under Full (strict). Visitors already reached Cloudflare.

How is 526 different from Cloudflare 525? +

525 means the TLS handshake to the origin failed. 526 means Cloudflare got far enough to decide the origin certificate is invalid under Strict rules. Fix listeners/ciphers for many 525s; fix certificate validity details for 526.

Will switching to Flexible SSL fix 526 for good? +

It may stop 526 by avoiding HTTPS to the origin, but it weakens encryption and often creates redirect loops with WordPress force-HTTPS plugins. Prefer a valid origin certificate and Full (strict).

Do I need a paid certificate to clear 526? +

Not necessarily. Let’s Encrypt/AutoSSL or a free Cloudflare Origin CA certificate is enough when installed correctly for Full (strict).

Why does Full work but Full (strict) show 526? +

Full encrypts to the origin without requiring a publicly trusted, name-matched cert the way Strict does. Strict is telling you the origin certificate still fails validation—repair that cert rather than living on Full forever if you want Strict’s guarantee.

Can a WordPress plugin cause 526? +

Almost never directly. Plugins do not present the origin TLS certificate to Cloudflare. They can only confuse testing with redirects; the certificate and chain still belong to the host/web server.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

You will receive a clear explanation of the likely cause.
We will tell you if the issue falls outside our repair scope.
No additional work will be performed without approval.
A backup should be created whenever access and website condition allow it.

Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.