526 Invalid SSL Certificate — Causes & Fix
HTTP 526 (Invalid SSL Certificate) means Cloudflare could not validate the origin server's SSL certificate (used with Full (Strict) SSL mode).
- Applies to
- Any website or web server (HTTP standard)
- Time to fix
- 15 minutes – 2 hours
What it means
Causes include an expired, self-signed, or hostname-mismatched origin certificate, or an incomplete certificate chain. This is a Cloudflare-specific status code (not part of the HTTP standard). Cloudflare returns it when it sits in front of a site and has a problem reaching or getting a valid response from the origin (your) server — so the fix is almost always at the origin, not with the visitor.
Symptoms
- Cloudflare "Error 526" page
- HTTPS to the origin rejected under Full (Strict)
How to fix it
- 1
Install a valid certificate (operator)
1. Put a valid, trusted, unexpired certificate on the origin with the correct hostname and full chain. 2. Or use a free Cloudflare Origin Certificate.
- 2
Adjust SSL mode
1. If needed, use "Full" instead of "Full (Strict)" — but a valid origin cert is the proper fix.
Frequently asked questions
526 vs 525?
525 is a failed TLS handshake; 526 is a handshake that worked but the origin certificate couldn't be validated (expired, self-signed, wrong hostname). Install a valid origin cert.
Last updated July 20, 2026
Guidance only — always consult a qualified professional or the official service manual before carrying out repairs.