Cloudflare Error 525: SSL handshake failed with the origin
Also searched as: error 525 · 525 ssl handshake failed
Is Cloudflare Error 525 happening on your domain?
An SSL check against the origin reveals whether it can complete a handshake at all, independently of Cloudflare.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
Cloudflare reached the origin on port 443 but could not complete a TLS handshake. Check the origin certificate, protocol and cipher support, hostname/SNI configuration, and origin-side logs.
What Cloudflare Error 525 means
In Full and Full (Strict) modes Cloudflare connects to the origin over HTTPS. If that handshake fails, visitors see 525 even though Cloudflare's own edge certificate is perfectly healthy.
Causes and fixes, most likely first
The origin has no certificate installed on port 443.
Install a certificate on the origin — a free Cloudflare Origin Certificate is the simplest option and lasts 15 years.
The origin's cipher suites do not overlap with Cloudflare's.
Enable TLS 1.2/1.3 with a standard modern cipher list on the origin.
SNI is required by the origin but the Host does not match its certificate.
Ensure the origin's certificate covers the hostname Cloudflare sends, or configure a matching default vhost.
How to stop it happening again
- •Monitor the origin certificate separately from the edge certificate — they expire on different schedules and only one is visible to visitors.
Frequently asked questions
My site shows a valid certificate — why 525?
The certificate visitors see is Cloudflare's edge certificate. 525 is about the second leg, from Cloudflare to your origin, which has its own certificate.