TroubleByteSearch
SOURCE VERIFIEDSource review Sep 7, 2026No hands-on test claimed2 sources

Cloudflare Error 526: invalid SSL certificate

Cloudflare Error 526 is a certificate-validation failure at the origin under Full (Strict). Check the origin certificate’s expiry, hostname coverage, chain and trust source, and confirm the origin serves the correct certificate for the requested hostname.

AuthorshipWritten and source-reviewed by Mihailo Ivanjac
Record created Sep 7, 2026Last source review Sep 7, 2026Source review only
SymptomVisitors receive Cloudflare Error 526 Invalid SSL certificate while the zone uses Full (Strict) origin encryption.
Problem familyNetworking · Networking
Highest step riskSafe
Editorial statePublic launch · indexed
Affected scope
Cloudflare proxyFull (Strict)Origin certificatesCloudflare Origin CA
Start here

Fix origin certificate validation

Inspect the certificate served by the origin for the production hostname. It must be valid for the hostname, unexpired and chain to a CA Cloudflare accepts or use a Cloudflare Origin CA certificate.

  1. Inspect the certificate served by the origin using the production hostname/SNI.
  2. Confirm it is unexpired, not revoked and covers the hostname in CN/SAN.
  3. Serve the required intermediate chain and use a CA trusted by Cloudflare or a Cloudflare Origin CA certificate.
  4. Reload/restart the origin TLS service and retest.

Why this branch first: Cloudflare’s 526 guidance requires a certificate that Full (Strict) can validate for the requested hostname.

TroubleByte diagnostic diagram for Cloudflare Error 526 showing certificate validation under Full strict mode.
Cloudflare 526 certificate-validation pathTroubleByte · Original TroubleByte editorial diagram
Visual diagnosis

TroubleByte diagnostic path

01
Mode

Confirm Full (Strict).

02
Certificate

Inspect what the origin actually serves.

03
Validation

Check expiry, hostname, issuer and chain.

04
SNI

Ensure the correct certificate is selected for the hostname.

Original TroubleByte diagnostic map. It summarizes the cited troubleshooting order; it is not a vendor screenshot.

Diagnosis

What this usually means

Unlike Error 525, which is a handshake failure, Error 526 specifically means Cloudflare could not validate the origin certificate in Full (Strict). That narrows the evidence to certificate validity and presentation: expiration/revocation, hostname/SAN match, issuer/trust chain, complete intermediates and the certificate actually selected by SNI at the origin.

What the evidence establishes

What we verified from the source material

Cloudflare defines 526 as inability to validate the origin certificate under Full (Strict). Current requirements include an unexpired certificate, valid trust source, hostname match and a complete certificate chain served by the origin.

Before you change anything

Prerequisites and checks

Prepare first

  • Have origin TLS configuration access.
  • Know whether the origin uses a public CA, Cloudflare Origin CA or custom trust store.
  • Preserve the current certificate/key before replacement.

Checks that prevent the wrong fix

  • Confirm the zone is using Full (Strict).
  • Inspect the certificate actually served by the origin for the production hostname/SNI.
  • Check expiry, SAN/hostname match and intermediate chain.
Scope

Applies to

✓ Cloudflare proxy✓ Full (Strict)✓ Origin certificates✓ Cloudflare Origin CA
Troubleshooting path

Solutions, in order

01
SAFE · START HERE

Fix origin certificate validation

  1. Inspect the certificate served by the origin using the production hostname/SNI.
  2. Confirm it is unexpired, not revoked and covers the hostname in CN/SAN.
  3. Serve the required intermediate chain and use a CA trusted by Cloudflare or a Cloudflare Origin CA certificate.
  4. Reload/restart the origin TLS service and retest.

Why this can work: Cloudflare’s 526 guidance requires a certificate that Full (Strict) can validate for the requested hostname.

02
SAFE

Correct SNI/virtual-host certificate selection

  1. Check the origin virtual host/SNI mapping for the affected hostname.
  2. Confirm port 443 serves the intended certificate and complete chain.
  3. Remove stale/default certificate mappings that override the hostname.
  4. Retest through Cloudflare in Full (Strict).

Why this can work: A valid certificate elsewhere on the server does not help if the origin presents the wrong one for the hostname.

Verification

How to know the fix actually worked

  1. The origin certificate validates for the production hostname with a complete chain.
  2. Cloudflare requests complete without Error 526 while Full (Strict) remains enabled.

Do not count a temporary disappearance of the symptom as a confirmed fix if the problem normally returns after a restart, reconnect or several minutes of use.

Stop conditions

When not to keep changing things

  • Do not permanently downgrade TLS validation merely to suppress 526; fix origin certificate validity/presentation.

Escalation: If the origin certificate validates correctly outside Cloudflare but 526 persists, collect the exact served chain/SNI details and contact hosting or Cloudflare support.

Evidence

Sources used for this record

Primary · checked Sep 7, 2026Cloudflare — Error 526First-party documentation used as the primary evidence source for this troubleshooting record.Corroborating · checked Sep 7, 2026Cloudflare — Full (strict) - SSL/TLS encryption modesFirst-party documentation used as the corroborating evidence source for this troubleshooting record.
Who reviewed this

Mihailo Ivanjac

This record was written and source-reviewed by Mihailo Ivanjac. Source review means the cited documentation was checked against the troubleshooting order on this page; it does not imply a hands-on reproduction unless the page explicitly says so.

Author profile and editorial scope →
Community troubleshooting

Discuss this exact problem

Share what happened on your system, ask a focused follow-up question, or add evidence that may help someone with the same symptom. Community posts are separate from TroubleByte editorial verification.

Before posting Do not include passwords, API keys, recovery codes, private IP addresses or other secrets. TroubleByte automatically attaches only coarse OS, browser and device-class context. Your full Browser & System Info report is not uploaded automatically.
Start a discussion
Posts are public. Guest identity is pseudonymous and browser-specific.

Loading community discussions…
Keep diagnosing

Related Networking problems

CloudflareCloudflare Error 523: Origin is unreachableCloudflare 523 is a routing/reachability problem: Cloudflare cannot contact the configured origin because the origin IP is wrong or the network path has no usable route. It is distinct from 521 refusal and 522 timeout, so the fastest checks are DNS origin address and routing evidence rather than application code.CloudflareCloudflare Error 524: A timeout occurredCloudflare 524 means the TCP connection to the origin succeeded, but the origin did not return an HTTP response within the proxy read timeout (125 seconds by default) or did not complete a write in time. That makes slow application work, long database queries and resource saturation more relevant than firewall reachability.CloudflareCloudflare Error 521: Web server is downCloudflare defines Error 521 as the origin web server refusing connections from Cloudflare. Common causes include an offline origin application or security rules blocking Cloudflare IP ranges.
Change log

Revision history

Show 1 recorded revision

2026-09-07 — Created for the v0.9 launch-acceleration content pass from current first-party documentation; indexing remains disabled pending final launch review.