525: SSL handshake failed
What's your Cloudflare SSL/TLS encryption mode set to?
Full (Strict)
Full (Strict) mode requires your origin to present a certificate signed by a trusted CA (or Cloudflare's Origin CA) — Cloudflare couldn't complete the handshake, which usually means that certificate is missing, expired, or self-signed.
Check
Check your origin's TLS certificate — is it currently valid, unexpired, and signed by a CA (or a Cloudflare Origin CA certificate)?
Fix
Install a valid CA-signed certificate, or generate and install a free Cloudflare Origin CA certificate on your origin.
Verify
Retry the request through Cloudflare and confirm the SSL error is gone.
Full, or not sure
Cloudflare couldn't complete an SSL handshake with your origin — commonly an expired/invalid certificate, or the origin not supporting a TLS version Cloudflare requires.
Check
Check your origin's certificate expiry date and which TLS versions it supports (TLS 1.2+ is required).
Fix
Renew the expired certificate, or update your origin's TLS configuration to support TLS 1.2 or higher.
Verify
Retry the request through Cloudflare and confirm the SSL handshake now succeeds.
Want to narrow it down interactively instead? Use the error lookup tool.