SSL handshake failed 525

Reference guide

What's your Cloudflare SSL/TLS encryption mode set to?

Full (Strict)

Request path

  1. You (reached)
  2. DNS (reached)
  3. Cloudflare edge (reached)
  4. Origin (not reached)

handshake fails

Full (Strict) mode requires your origin to present a certificate signed by a trusted CA (or Cloudflare's Origin CA) — Cloudflare couldn't complete the handshake, which usually means that certificate is missing, expired, or self-signed.

What to do

  1. Check. Check your origin's TLS certificate — is it currently valid, unexpired, and signed by a CA (or a Cloudflare Origin CA certificate)?
  2. Fix. Install a valid CA-signed certificate, or generate and install a free Cloudflare Origin CA certificate on your origin.
  3. Verify. Retry the request through Cloudflare and confirm the SSL error is gone.

Full, or not sure

Request path

  1. You (reached)
  2. DNS (reached)
  3. Cloudflare edge (reached)
  4. Origin (not reached)

handshake fails

Cloudflare couldn't complete an SSL handshake with your origin — commonly an expired/invalid certificate, or the origin not supporting a TLS version Cloudflare requires.

What to do

  1. Check. Check your origin's certificate expiry date and which TLS versions it supports (TLS 1.2+ is required).
  2. Fix. Renew the expired certificate, or update your origin's TLS configuration to support TLS 1.2 or higher.
  3. Verify. Retry the request through Cloudflare and confirm the SSL handshake now succeeds.

Want to narrow it down interactively instead? Use the error lookup tool.