Cloudflare Error 526: Invalid SSL certificate on the origin
Also searched as: error 526 · 526 invalid ssl certificate
Is Cloudflare Error 526 happening on your domain?
The SSL check reports the origin certificate's expiry, issuer and covered hostnames — the three things Full (Strict) validates.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
Cloudflare completed the handshake with the origin but refused its certificate — expired, self-signed, or not matching the hostname — because the SSL mode is Full (Strict).
What Cloudflare Error 526 means
Full (Strict) validates the origin certificate. 526 means that validation failed. Switching to Full stops the error but also stops the validation, so it is a workaround rather than a fix.
Causes and fixes, most likely first
The origin certificate expired.
Renew the origin certificate and reload the origin's web server.
The origin uses a self-signed certificate under Full (Strict).
Install a Cloudflare Origin Certificate, which Full (Strict) trusts, or a publicly trusted certificate.
The origin certificate does not cover the hostname.
Reissue the origin certificate with the correct hostname in its SAN list.
How to stop it happening again
- •Track origin certificate expiry with the same alerting as public certificates; nothing visible to visitors warns you first.
Frequently asked questions
Should I switch to Full to fix 526?
It removes the error but also removes origin certificate validation, leaving the Cloudflare-to-origin leg unauthenticated. Fix the origin certificate and stay on Full (Strict).