---
title: "Cloudflare Error 525 — test your site, then fix it"
description: "Run a free live check to see whether Cloudflare Error 525 is happening on your own domain right now, then work through the causes ranked most likely first."
canonical: "https://lemwatch.com/errors/cloudflare-525"
source: "https://lemwatch.com"
---

# Cloudflare Error 525: SSL handshake failed with the origin

> Cloudflare reached the origin on port 443 but could not complete a TLS handshake. Check the origin certificate, protocol and cipher support, hostname/SNI configuration, and origin-side logs.

## Short answer

 Cloudflare reached the origin on port 443 but could not complete a TLS handshake. Check the origin certificate, protocol and cipher support, hostname/SNI configuration, and origin-side logs.

## What Cloudflare Error 525 means

 In Full and Full (Strict) modes Cloudflare connects to the origin over HTTPS. If that handshake fails, visitors see 525 even though Cloudflare's own edge certificate is perfectly healthy.

## Causes and fixes, most likely first

- The origin has no certificate installed on port 443. Install a certificate on the origin — a free Cloudflare Origin Certificate is the simplest option and lasts 15 years.
- The origin's cipher suites do not overlap with Cloudflare's. Enable TLS 1.2/1.3 with a standard modern cipher list on the origin.
- SNI is required by the origin but the Host does not match its certificate. Ensure the origin's certificate covers the hostname Cloudflare sends, or configure a matching default vhost.

## How to stop it happening again

- Monitor the origin certificate separately from the edge certificate — they expire on different schedules and only one is visible to visitors.

## Check your own domain

 An SSL check against the origin reveals whether it can complete a handshake at all, independently of Cloudflare.

## Frequently asked questions

### My site shows a valid certificate — why 525?

 The certificate visitors see is Cloudflare's edge certificate. 525 is about the second leg, from Cloudflare to your origin, which has its own certificate.



## Lemwatch at a glance

- What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool.
- Free plan: 10 sites, no time limit, all check types.
- Pro: $19/mo, 50 sites, public API and webhooks.
- Agency: $59/mo, 150 sites, white-label status pages.
- Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits).



## Related

- [All website error codes](https://lemwatch.com/errors)
- [SSL handshake failed](https://lemwatch.com/errors/ssl-handshake-failed)
- [Cloudflare Error 526](https://lemwatch.com/errors/cloudflare-526)
- [ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [Cloudflare Error 524 on WordPress](https://lemwatch.com/errors/cloudflare-524/in-wordpress)
- [All monitoring checks](https://lemwatch.com/features)