Skip to content
Webmaster Tools
Inspect & debugHTTP Status Codes526 Invalid SSL Certificate

526 Invalid SSL Certificate

What Cloudflare error 526 (invalid SSL certificate) means, why Full (strict) rejects your origin certificate, and how to fix it with an Origin CA or trusted certificate.

All status codes

What 526 means

526 is not a standard HTTP status code; Cloudflare sends it from its edge. It means Cloudflare completed the TLS handshake with your origin, but couldn't validate the origin's certificate. It appears when the zone's SSL/TLS encryption mode is Full (strict), the mode in which Cloudflare checks the origin certificate the way a browser would.

HTTP/2 526
server: cloudflare
cf-ray: 8c1f2a3b4d5e6f70-SYD
content-type: text/html

<title>example.com | 526: Invalid SSL certificate</title>

In Full (strict), Cloudflare requires the origin certificate to be:

  • unexpired and not revoked,
  • issued by a trusted authority: a publicly trusted CA or Cloudflare's own Origin CA, so self-signed certificates fail,
  • for the right name: the requested hostname must be in the certificate's Common Name or Subject Alternative Names.

Common causes

  • The origin certificate expired, typically a Let's Encrypt renewal that stopped working, for example because the HTTP challenge can't get through Cloudflare or a renewal hook never reloaded the server.
  • A self-signed certificate, such as the default one a control panel or distribution installs.
  • A hostname mismatch: the certificate covers example.com but not www.example.com or a subdomain, or the origin serves the certificate of a different site on the same IP.

How to fix it

  1. Look at the certificate the origin presents to Cloudflare:

    openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

    Check the dates, the issuer and that every proxied hostname appears in the SAN list.

  2. Install a Cloudflare Origin CA certificate. Create it in the dashboard under SSL/TLS, Origin Server; it can cover the apex and a wildcard and can be valid for up to 15 years. Cloudflare trusts it, browsers don't, so use it only on hostnames that stay proxied (orange cloud).

  3. Or use a publicly trusted certificate, such as Let's Encrypt. If renewals fail through Cloudflare, use the DNS-01 challenge, which doesn't depend on reaching the origin over HTTP.

  4. Fix name coverage: issue the certificate for every hostname you proxy, and make sure the right virtual host answers for each name (SNI).

  5. Reload the web server after replacing the certificate, then retry.

Dropping to Full (not strict) makes the error go away, because that mode accepts any certificate, including expired and self-signed ones. It still encrypts the connection but no longer proves it reaches your server. Treat it as a stopgap and go back to Full (strict).

526 and SEO

Googlebot receives the 526 status from Cloudflare and treats it as a server error. A short gap after a failed renewal is recoverable, but if it lasts, Google crawls less and URLs that keep failing drop out of the index. Monitoring the origin certificate's expiry date prevents most 526s.

Inspect the certificate chain and expiry visitors see with the SSL Inspector, and the response through Cloudflare with the Redirect Checker.