Cloudflare 525 SSL Handshake Failed

What Cloudflare 525 means

With SSL mode Full or Full (strict), Cloudflare connects to the origin over HTTPS. 525 means that handshake failed, for example because the origin has no certificate on port 443, doesn’t support SNI, or has no cipher in common with Cloudflare.

525 isn’t defined in any HTTP standard. It is specific to Cloudflare, so other servers and proxies won’t use it.

How to fix error 525

• Test from outside: openssl s_client -connect origin-ip:443 -servername example.com.

Retrying

Rarely. The server can’t handle this request, so retrying it unchanged is unlikely to help.

Example response

HTTP/1.1 525 SSL Handshake Failed
Date: Wed, 21 Oct 2026 10:30:00 GMT
Server: cloudflare
CF-RAY: 8c2f6a1e3b9d4e21-FRA
Content-Type: text/html; charset=UTF-8

Related status codes

• 526 Invalid SSL Certificate : The origin’s TLS certificate isn’t valid.
• 520 Web Server Returned an Unknown Error : The origin server returned an empty, unknown or unexpected response.
• 502 Bad Gateway : A proxy or gateway got an invalid response from the upstream server.

Other 5xx status codes

500 Internal Server Error · 501 Not Implemented · 502 Bad Gateway · 503 Service Unavailable · 504 Gateway Timeout · 505 HTTP Version Not Supported · 507 Insufficient Storage · 508 Loop Detected · 511 Network Authentication Required · 520 Web Server Returned an Unknown Error · 521 Web Server Is Down · 522 Connection Timed Out · 523 Origin Is Unreachable · 524 A Timeout Occurred · 526 Invalid SSL Certificate

See the full list of HTTP status codes.

Sources

• Cloudflare docs: 5xx errors

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions