Error guide

525 SSL Handshake Failed

Cloudflare reached your origin but could not complete the TLS handshake with it.

525 means Cloudflare connected to your origin successfully and then failed to establish TLS with it. The TCP connection worked; the negotiation on top of it did not. This is specifically about the Cloudflare-to-origin leg, not the visitor-to-Cloudflare one, which is why visitors see an error while your certificate looks fine in a browser.

The usual cause is the SSL mode setting. Cloudflare's Full and Full (strict) modes connect to the origin over HTTPS, so an origin that serves only plain HTTP, or has nothing listening on port 443, produces a 525 immediately. A certificate that is present but fails validation is a different error: under Full (strict) that is 526.

The rest are ordinary TLS problems on the origin: no certificate installed at all, an origin that does not support SNI, or no TLS version or cipher suite in common with Cloudflare, which now happens most often when an origin is old enough that its supported versions have been dropped.

Common causes

  • Cloudflare's SSL mode set to Full or Full (strict) against an origin with nothing serving HTTPS: plain HTTP only, or nothing listening on port 443.
  • No certificate installed on the origin's HTTPS listener.
  • An origin that does not support SNI.
  • No overlapping TLS version or cipher suite between Cloudflare and an old origin.

How to diagnose it

  1. Check Cloudflare's SSL mode against what the origin actually serves on port 443.
  2. Run openssl s_client -connect <origin-ip>:443 -servername <hostname> and check that a handshake completes and a certificate comes back.
  3. If the handshake completes and Cloudflare still reports an error, read the certificate: under Full (strict) a certificate that fails validation is a 526, not a 525.
  4. Check the TLS versions and cipher suites the origin supports: an origin limited to old versions will fail against a modern client.
  5. Confirm the origin's web server supports SNI and serves a certificate when asked for the requested hostname.

Whose fault is it? The server's side

Origin-side, in the sense that the origin's TLS configuration and Cloudflare's expectation disagree. Which of the two to change depends on whether the origin is supposed to serve HTTPS at all.

What monitoring sees

A visitor-facing monitor sees the 525 as an HTTP response from Cloudflare and fails the check on it, without seeing why. An SSL Certificate monitor pointed at the origin's own hostname, one that is not proxied through Cloudflare, connects straight to the origin and fails when no TLS handshake completes there, which is the 525 condition seen from outside.

Product feature

Related error guides

Terms used on this page

Questions

Why does 525 happen when my SSL certificate is valid?

Because the certificate visitors see is Cloudflare's, and 525 is about your ORIGIN. A missing certificate there, nothing listening on port 443, or no TLS version or cipher in common fails the handshake while the public-facing certificate looks perfect.

Does switching Cloudflare to Flexible SSL fix 525?

It removes the error by connecting to the origin over plain HTTP, which leaves that leg unencrypted. It is a diagnosis, not a fix — the correct answer is to serve a valid certificate on the origin.

One of the Uptimely HTTP and network error guides, written for the person who operates the server rather than the one refreshing the page. Something here read wrong to you? Email support@getuptimely.com.