---
title: "Cloudflare Error 526: causes and how to fix it"
description: "Cloudflare completed the handshake with the origin but refused its certificate — expired, self-signed, or not matching the hostname — because the SSL mode is…"
canonical: "https://lemwatch.com/errors/cloudflare-526"
source: "https://lemwatch.com"
---

# Cloudflare Error 526: Invalid SSL certificate on the origin

> Cloudflare completed the handshake with the origin but refused its certificate — expired, self-signed, or not matching the hostname — because the SSL mode is Full (Strict).

## Short answer

 Cloudflare completed the handshake with the origin but refused its certificate — expired, self-signed, or not matching the hostname — because the SSL mode is Full (Strict).

## What Cloudflare Error 526 means

 Full (Strict) validates the origin certificate. 526 means that validation failed. Switching to Full stops the error but also stops the validation, so it is a workaround rather than a fix.

## Causes and fixes, most likely first

- The origin certificate expired. Renew the origin certificate and reload the origin's web server.
- The origin uses a self-signed certificate under Full (Strict). Install a Cloudflare Origin Certificate, which Full (Strict) trusts, or a publicly trusted certificate.
- The origin certificate does not cover the hostname. Reissue the origin certificate with the correct hostname in its SAN list.

## How to stop it happening again

- Track origin certificate expiry with the same alerting as public certificates; nothing visible to visitors warns you first.

## Check your own domain

 The SSL check reports the origin certificate's expiry, issuer and covered hostnames — the three things Full (Strict) validates.

## Frequently asked questions

### Should I switch to Full to fix 526?

 It removes the error but also removes origin certificate validation, leaving the Cloudflare-to-origin leg unauthenticated. Fix the origin certificate and stay on Full (Strict).


## Related

- [All website error codes](https://lemwatch.com/errors)
- [Cloudflare Error 525](https://lemwatch.com/errors/cloudflare-525)
- [ERR_CERT_DATE_INVALID](https://lemwatch.com/errors/err-cert-date-invalid)
- [ERR_CERT_AUTHORITY_INVALID](https://lemwatch.com/errors/err-cert-authority-invalid)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [DNS_PROBE_FINISHED_BAD_CONFIG: The DNS configuration is invalid](https://lemwatch.com/errors/dns-probe-finished-bad-config)
- [Website monitoring overview](https://lemwatch.com/website-monitoring)