Why Am I Getting Cloudflare Error 526: Invalid SSL Certificate?

Everything people find confusing about this error follows from that pairing. A certificate can be broken for months without anyone noticing, because in every other mode Cloudflare does not look. So “Cloudflare 526” is rarely a report that something just broke at your origin — more often it is a report that something started being checked. Like the rest of the family, error code 526 is generated at Cloudflare’s edge rather than by your application, so your own logs may show nothing at all, and it can only occur on a proxied record.

Two conditions, and both have to hold

Cloudflare’s documentation for error 526 states the two conditions explicitly: Cloudflare cannot validate the SSL certificate at your origin web server, and Full (strict) is the encryption mode set for the domain. The second condition is what makes this an invalid SSL certificate error rather than a connection error, because Full mode connects to the origin over HTTPS without validating the origin’s certificate — it is documented as the mode for origins with self-signed or otherwise invalid certificates. No validation, no 526.

What makes a certificate invalid to Cloudflare

Cloudflare’s edge trusts certificates issued by a certificate authority in its own published trust store. The 526 checklist in the docs is really a list of ways to fall outside it:

The incomplete chain is the one worth singling out, because it is the case where your site looks fine in a browser and still returns 526. Cloudflare requires the origin to serve the leaf certificate together with any required intermediates, so that a trusted chain up to a root CA can be built. If your server only sends the leaf, there is nothing for Cloudflare to build with.

526 vs 525: rejected, not un-negotiated

These two are the pair people mix up, and the split is clean: 525 is a handshake that never finished, 526 is a handshake that finished and produced something Cloudflare would not accept.

Why it started on a site nobody touched

Three mechanisms account for most “this was working yesterday” reports, and none of them involves anyone editing a server.

• Automatic SSL/TLS moved you to Full (strict). Cloudflare’s encryption mode setting now defaults to a mode chosen for you by the SSL/TLS Recommender, which upgrades gradually — 1% of traffic, then 10% increments — and aborts if origin connectivity fails during the rollout. That is the benign path. The trap comes later: Cloudflare states plainly that Automatic SSL/TLS will notmove you back to a less secure mode if your origin certificate later expires. Once you are on Full (strict), you own that certificate’s validity for good.
• A Cloudflare Origin CA certificate quietly expired. These are long-lived, which is the point, and Cloudflare documents that it does not currently send expiration notifications for them. A certificate issued years ago by someone who has since left is exactly the kind of thing that surfaces as a sudden 526.
• A renewal reinstalled the leaf without its intermediates. Automated renewals usually get this right; a hand-copied .crt file often does not.

Confirming it yourself

Ask the origin directly, with Cloudflare out of the path, so you see the same chain Cloudflare sees:

# Ask the origin directly what chain it serves, bypassing Cloudflare
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null

# Look for these three lines in the output:
#   Certificate chain      -> must include the intermediate, not just the leaf
#   Verify return code: 0  -> anything else is what Cloudflare is rejecting
#   notAfter=...           -> the expiry date, in UTC

Cloudflare’s own suggestion is the browser-based equivalent: pause Cloudflare and run your hostname through an SSL checker. Either way you are looking for the same three things: the chain includes an intermediate, the verification succeeds, and the expiry is in the future.

Three ways out, cheapest first

1. Install a Cloudflare Origin CA certificate. Free on every plan including Free, issued from the dashboard, and trusted by Cloudflare by design. One caveat that catches people: these certificates encrypt only the Cloudflare-to-origin hop and are not publicly trusted, so if you later switch that record to DNS only, visitors will see certificate warnings.
2. Upload your CA to the Custom Origin Trust Store. The route for an internal or private CA — but it requires Advanced Certificate Manager on the zone, and once a CA is uploaded Cloudflare ignores its default trust store for that zone entirely and uses only what you supplied.
3. Drop to Full.Cloudflare lists this first as a “potential quick fix”, and it does stop the error immediately — because the check stops happening. Traffic to your origin stays encrypted but unauthenticated. Treat it as a way to buy an afternoon, not a resolution.

Two places where your zone setting does not apply

Both are documented, and both produce a 526 on a zone that is not in Full (strict) at all — which is why they are worth knowing before you spend an hour checking a setting that is already correct.

Workers. A subrequest from a Worker to a hostname outside your Cloudflare zone that is not proxied by Cloudflare always uses Full (strict), regardless of the zone configuration. If you need such a fetch to trust a private CA, the Custom Origin Trust Store applies only once the cots_on_external_fetch compatibility flag is enabled.

Cloudflare Gateway. In the Zero Trust path a 526 means Gateway distrusted the origin — an unknown or revoked issuer, an expired certificate anywhere in the chain, a name mismatch, or a name containing characters such as underscores that Chrome tolerates and Gateway does not. Gateway also refuses origins that offer only insecure cipher suites, or that redirect every HTTPS request to HTTP.

Where 526 sits among the origin errors

Read down that column and the family becomes a single sequence: each error is the connection getting one step further before failing. A 526 is the furthest of the four, which is genuinely good news — the network path works, the port is open, TLS negotiates. Only the paperwork is wrong. The 5xx index covers the rest of the family, and the guide to the encryption modes covers the setting that decides whether the paperwork gets checked.

FAQ