SSL handshake failed: The TLS handshake did not complete
Also searched as: SSL handshake failure · handshake_failure · Cloudflare error 525
Is SSL handshake failed happening on your domain?
An external handshake attempt can distinguish a publicly reproducible TLS problem from a local-network issue and report the certificate and protocol information it can observe.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
A generic handshake failure reported by servers, CDNs and API clients rather than browsers. The connection reached the server but the TLS negotiation aborted — protocol mismatch, certificate rejection, or a required client certificate.
What SSL handshake failed means
The phrase appears in nginx logs, Cloudflare 525 pages, curl output and API SDKs. It generally indicates that a TCP connection was made but TLS negotiation did not complete. The useful diagnosis depends on which side logged it and on the related TLS error details.
Causes and fixes, most likely first
No shared protocol or cipher between the two sides.
Compare the versions each side supports. Enable TLS 1.2/1.3 on the origin.
The server requires a client certificate that was not presented.
Present the client certificate, or turn off mutual TLS for that route if it was enabled unintentionally.
SNI is missing, so the server selects a default certificate that does not match.
Ensure the client sends SNI. Very old clients and some scripted requests omit it.
How to stop it happening again
- •Log the TLS version and cipher on the origin so handshake failures can be attributed rather than guessed.
Frequently asked questions
What is the difference between a handshake failure and a certificate error?
A certificate error means the handshake completed far enough for the browser to inspect and reject the certificate. A handshake failure means negotiation aborted before that point.