SSL error fix
Cloudflare Error 526: Invalid SSL Certificate – Causes and Fix
Cloudflare error 526 appears when Cloudflare cannot validate the SSL certificate on your origin server. Here is what causes it, how to fix it and which origin certificate to use.
Cloudflare error 526 (“Invalid SSL certificate”) means Cloudflare reached your origin server over HTTPS but rejected the certificate it found there. It only happens when your SSL/TLS encryption mode is set to Full (strict), the mode that checks the origin certificate the way a browser would. Visitors see the error page; your server itself is usually still running.
The fix is almost always on the origin: install a valid, unexpired certificate that matches the hostname and includes its intermediates.
| Key fact | Detail |
|---|---|
| Triggered by | SSL/TLS mode Full (strict) plus an origin certificate Cloudflare cannot validate |
| Valid origin certificate | Unexpired, not revoked, issued by a public CA or Cloudflare Origin CA, hostname in CN or SAN |
| Port | The origin must accept HTTPS on port 443 |
| Quick but weaker workaround | Switch to Full mode (encrypted, but no certificate check) |
Need a valid origin certificate fast?
A publicly trusted DV certificate passes Full (strict) and keeps working if traffic ever bypasses Cloudflare.
Compare DV SSL certificatesWhat does Cloudflare error 526 mean?
Error 526 means the certificate on your origin server failed Cloudflare’s validation while the zone uses Full (strict). Cloudflare acts as the browser here: it connects to your server, reads the certificate and refuses to continue if the certificate is not trustworthy.
The error is specific to the Cloudflare-to-origin leg. The certificate visitors see in their browser is Cloudflare’s edge certificate, which is why the padlock can look fine while the page still fails. For other browser warnings, see our overview of SSL certificate errors.
How Cloudflare’s SSL modes treat your origin
| Mode | Cloudflare → origin | Origin certificate checked? | Can show 526? |
|---|---|---|---|
| Flexible | Plain HTTP | No certificate needed | No |
| Full | HTTPS | No – any certificate accepted | No |
| Full (strict) | HTTPS | Yes – dates, issuer, hostname | Yes |
Common causes of the invalid SSL certificate error code 526
Six conditions on the origin cause a 526. Work through them from top to bottom; the first two are the quickest to confirm.
| Cause | How to spot it | Fix |
|---|---|---|
| Expired certificate | “Valid to” date in the past | Renew and install the new certificate |
| Hostname mismatch | Domain not in Common Name or SAN list | Reissue with the right names (or a wildcard) |
| Self-signed certificate | Issuer equals subject | Install a public or Cloudflare Origin CA certificate |
| Missing intermediates | Checker reports an incomplete chain | Install the CA bundle with the certificate |
| Revoked certificate | Checker shows “revoked” | Reissue and install the replacement |
| No HTTPS on port 443 | Connection refused or plain HTTP on 443 | Enable an HTTPS listener on 443 |
Watch your subdomains
Hostname mismatches often hide in subdomains. A certificate for example.com does not cover www.example.com unless both names are listed. A wildcard such as *.example.com covers one level only, so api.eu.example.com needs its own name or its own certificate. Check every proxied hostname in your DNS, not just the main domain.
How to fix Cloudflare error 526
Test the origin directly
Temporarily pause Cloudflare for the site or test the origin hostname with an SSL checker, so you see the origin certificate rather than Cloudflare's edge certificate.
Read the result
Note the expiry date, the names in the certificate, the issuer and whether the chain is complete.
Install a valid certificate
Install a publicly trusted certificate or a Cloudflare Origin CA certificate that covers every proxied hostname, together with its intermediates.
Resume and retest
Re-enable Cloudflare, keep Full (strict) and reload the page. Purge the cache if an old error page is still served.
Our SSL checker shows the issuer, validity dates, names and chain status for any hostname. If it reports a missing intermediate, read how the certificate chain works and add the CA bundle your certificate authority supplied.
Tip: An expired origin certificate is an easy one to miss, because Cloudflare does not warn you before an Origin CA certificate expires. If yours has lapsed, follow our steps to renew an SSL certificate and put the next expiry date in your calendar.
Cloudflare Origin certificate or public SSL certificate?
Use a Cloudflare Origin CA certificate only if every request reaches your server through Cloudflare’s proxy. Use a publicly trusted certificate if traffic might ever bypass Cloudflare, because browsers do not trust Origin CA certificates.
| Cloudflare Origin CA certificate | Public SSL certificate | |
|---|---|---|
| Trusted by | Cloudflare only | Cloudflare, browsers, apps and APIs |
| Works if you pause Cloudflare or set a record to DNS-only | No – visitors see certificate warnings | Yes |
| Expiry reminders | None from Cloudflare – track it yourself | From your certificate provider |
| Validation shown in certificate | None | DV, OV or EV |
| Typical fit | Sites that are always proxied | Sites that may switch CDN, use DNS-only records or serve other clients |
A domain validated (DV) SSL certificate is the simplest public option for an origin server. It proves domain control only, which is all Full (strict) checks, and it keeps the site working if you ever turn off the proxy.
DV certificates that pass Full (strict)
Best value Comodo
Comodo PositiveSSL
- Domain Validation (DV)
- Issued in minutes
- Covers domain and www
from $7.20 / year
Best value RapidSSL
RapidSSL Certificate
- Domain Validation (DV)
- Issued in minutes
- DigiCert-backed brand
from $13.33 / year
Fast issuance Comodo
Comodo EssentialSSL
- Domain Validation (DV)
- Near-instant issuance
- www and non-www covered
from $15.20 / year
Automated renewals RapidSSL
RapidSSL Plan + Automate
- Automatic issuance and renewal
- ACME or AutoInstall SSL
- Domain Validation (DV)
$19.99
Can I just switch to Flexible mode?
You can, and the error will disappear, but Flexible sends all traffic between Cloudflare and your server as plain HTTP. Anyone on that network path could read or change it, so Cloudflare itself advises against Flexible for sites with logins or personal data.
Flexible also causes redirect loops when your origin already forces HTTPS. Switching to Full is a better short-term step because traffic stays encrypted, but it accepts any certificate, including an expired one. Treat both as a stopgap and return to Full (strict) once a valid certificate is installed.
Cloudflare Tunnel and SSL certificates
With Cloudflare Tunnel, the cloudflared connector on your network connects to your service. If that service uses https://, cloudflared verifies its certificate by default against the expected hostname, so the same rules apply: a valid certificate for the right name, or a configured private CA.
Fix error 526 for good
Install a publicly trusted DV certificate on your origin, keep Full (strict) on and stop worrying about who can see your origin traffic.
Compare DV SSL certificates