Skip to content
Webmaster Tools
Inspect & debugHTTP Status Codes525 SSL Handshake Failed

525 SSL Handshake Failed

What Cloudflare error 525 (SSL handshake failed) means, why the TLS handshake between Cloudflare and your origin fails in Full or Full (strict) mode, and how to fix it.

All status codes

What 525 means

525 is not a standard HTTP status code; Cloudflare sends it from its edge. It means the TLS handshake between Cloudflare and your origin server failed. It only happens when the zone's SSL/TLS encryption mode is Full or Full (strict), the modes in which Cloudflare connects to the origin over HTTPS. The visitor's connection to Cloudflare is fine; the problem is the second leg, Cloudflare to origin.

HTTP/2 525
server: cloudflare
cf-ray: 8c1f2a3b4d5e6f70-NRT
content-type: text/html

<title>example.com | 525: SSL handshake failed</title>

If the handshake succeeds but the certificate fails validation in Full (strict), you get 526 instead.

Common causes

  • No certificate configured for the site on the origin, or HTTPS not set up on port 443 at all.
  • No SNI support: Cloudflare sends the host name in the TLS handshake (SNI), and the origin has no matching virtual host, or can't handle SNI.
  • No shared cipher suite or protocol: the origin only accepts old or unusual ciphers or TLS versions that Cloudflare doesn't offer.
  • A firewall or proxy on the origin that interrupts TLS connections from Cloudflare's IPs.

How to fix it

  1. Test the handshake the way Cloudflare does, against the origin IP with SNI:

    openssl s_client -connect 203.0.113.10:443 -servername example.com

    A working origin prints the certificate chain and a negotiated protocol and cipher. An immediate handshake failure or no peer certificate points at the certificate, SNI or cipher configuration.

  2. Install a certificate on the origin for the hostname: a free Cloudflare Origin CA certificate (trusted by Cloudflare, not by browsers) or a publicly trusted one such as Let's Encrypt.

  3. Check the virtual host answers for that name on 443: in nginx a server block with listen 443 ssl;, server_name example.com; and ssl_certificate / ssl_certificate_key; in Apache a <VirtualHost *:443> with SSLEngine on.

  4. Use a modern TLS configuration: TLS 1.2 and 1.3 with current ECDHE cipher suites.

  5. Allowlist Cloudflare's IP ranges on port 443 if a firewall or intrusion prevention tool sits in front of the server.

Switching the SSL mode to Flexible makes the error disappear, but only because Cloudflare then talks to the origin over plain HTTP. That leaves the second leg unencrypted and often causes redirect loops if the origin forces HTTPS. Fix the origin and use Full (strict).

525 and SEO

Googlebot gets the 525 from Cloudflare and treats it as a server error: crawling slows while it lasts, and URLs that keep failing for a long time are dropped from the index. Certificate renewals that go wrong are a common trigger, so monitor the origin certificate's expiry as well as the edge one.

Check the certificate visitors see with the SSL Inspector, and the site's status through Cloudflare with the Redirect Checker.