USD 
USD 
GBP 
EUR 
INR 
ZAR 
AUD 
CAD 
MYR 
SGD 
THB 
HKD 
BRL 
AED 
Error 525 (SSL Handshake Failed) means Cloudflare could not complete the SSL/TLS handshake with your origin web server. The visitor-to-Cloudflare connection succeeds, but Cloudflare cannot establish the second encrypted connection to the origin server. To fix this server-side configuration issue, you have to check your origin’s certificate, HTTPS configuration, and network access.
What Is SSL Handshake Failed Error Code 525?
Cloudflare Error 525 means that SSL handshake failed between Cloudflare and your origin web server. When a site runs through Cloudflare, there are two separate HTTPS connections. The visitor connects to Cloudflare, and Cloudflare then opens its own connection to your origin server.
Since the failure happens between Cloudflare and your server, that’s where troubleshooting should start. A missing certificate, unavailable HTTPS port, protocol mismatch, or firewall rule can interrupt the connection. Error 525 itself does not identify which issue caused the handshake to fail.
What Causes Error 525?
| Cause | What’s happening |
|---|---|
| Certificate unavailable or not loaded | The origin does not present a certificate, or the web server cannot load the configured certificate or private key |
| Port 443 unreachable | HTTPS is not running, or access to port 443 is blocked before the connection reaches the server. |
| SNI mismatch | Server returns the wrong certificate when more than one site shares an IP |
| TLS version mismatch | The origin and Cloudflare do not support a common TLS version |
| Cipher suite mismatch | Origin and Cloudflare can’t agree on a shared cipher |
| Firewall blocking Cloudflare | A firewall or security rule interrupts the connection before the TLS handshake completes |
Any one of these issues can cause Error 525. Working through them in order usually helps identify the source of the handshake failure quickly.
How to Fix SSL Handshake Failed Error 525
To resolve this error, work through your origin server’s certificate, port 443, SNI, TLS version, and firewall settings, covered step by step below.
Check your Cloudflare SSL/TLS encryption mode before troubleshooting. Error 525 occurs when Full or Full (Strict) mode is active and Cloudflare cannot complete the handshake with the origin. Do not use Flexible mode as a permanent fix.
-
Check the origin SSL certificate
Check the certificate through your hosting panel or server configuration. Confirm that it is installed, active, and correctly configured for the domain.
Certificate problems commonly appear after a server migration or renewal that was not fully applied.
-
Verify HTTPS and port 443
Your origin needs to be listening for HTTPS traffic on port 443, or whatever secure port you’ve configured. Test it against the server’s actual IP address instead of the public hostname. The hostname points to Cloudflare, so a successful test there only proves Cloudflare is reachable. It says nothing about your origin server.
-
Check hostname and SNI
If the server hosts more than one domain on a single IP address, confirm that Server Name Indication (SNI) is configured to return the correct certificate for the requested hostname. A wrong or default certificate usually points to a virtual host or server block that’s not correctly configured.
-
Check TLS versions and cipher suites
Cloudflare and the origin must support at least one common TLS version and cipher suite. A server limited to outdated protocols or an incompatible cipher list can fail the handshake even when a valid certificate is installed. For a modern origin configuration, enable TLS 1.2 and TLS 1.3 where supported.
-
Check firewall and network access
Allow Cloudflare’s current IPv4 and IPv6 ranges through the origin firewall, cloud security group, rate limiter, and security plugins. Use Cloudflare’s published list rather than IP ranges copied from an older guide.
-
Review the web server configuration
- For Apache, check the SSL virtual host.
- For Nginx, verify the HTTPS server block and certificate paths.
Look at anything that changed recently, since 525 errors tend to show up right after a server or configuration update.
-
Test the handshake directly
If none of the above turns anything up, testing the connection yourself will usually show exactly where it’s breaking down.
How to Diagnose Error 525
The most reliable way to see what’s happening is to bypass Cloudflare and talk to the origin server directly:
openssl s_client -connect ORIGIN_IP:443 -servername yourdomain.com
Using the origin’s IP address here matters. Connecting through the public hostname instead only tests Cloudflare’s edge, so a working result there tells you nothing about the origin itself.
The output shows:
- Whether the handshake completes
- Certificate presented by the server
- Negotiated TLS version
- Selected cipher
If it fails here, the problem is confirmed to be on the server, not somewhere between Cloudflare and the visitor. If none of that points to an answer, the origin’s own logs are worth checking. Look for anything referencing a handshake failure, an unsupported protocol, or a certificate load error, and match the timestamp against when the 525 occurred.
Error 525 vs. Error 526
These two errors are often confused because both involve the Cloudflare-to-origin connection, but they describe different failures.
Error 525 means the TLS handshake with the origin server failed. Error 526 means Cloudflare could not validate the SSL certificate presented by the origin server.
Which error appears depends partly on your Cloudflare SSL/TLS mode.
Under Full mode, Cloudflare encrypts the connection to your origin but does not validate the origin certificate. This means it can accept a self-signed certificate.
Under Full (Strict) mode, the origin certificate must be issued by a publicly trusted CA or Cloudflare Origin CA, be unexpired, and match the requested hostname. If the certificate fails any of these validation requirements, Cloudflare may return Error 526.
Replacing the certificate may help if the origin cannot present or load the existing certificate. However, it will not resolve a handshake failure caused by port access, SNI, TLS, cipher, or firewall configuration.
How to Prevent Error 525
To prevent Cloudflare Error 525, maintain a valid server certificate and a compatible origin configuration. Key prevention steps include:
Automate certificate renewal wherever your CA supports it. After each renewal, check that the web server is serving the renewed certificate instead of the previously installed one. Shorter TLS certificate lifespans will make reliable renewal processes increasingly important.
Use Full (Strict) with a properly issued, valid origin certificate; do not rely on a weaker mode to paper over a certificate problem.
Keep TLS 1.2 and 1.3 enabled and retire older protocol versions as your server software allows.
Recheck your firewall’s IP allow-list any time you update a security plugin or switch hosting providers, since that’s a common and easy-to-miss cause.
Frequently Asked Questions
Can firewall rules cause Error 525?
Can Error 525 happen even if my SSL certificate is valid?
Do I need my hosting provider’s help to fix error 525?
Why did Error 525 start right after I changed security settings?
Conclusion
Error 525 means Cloudflare could not complete an SSL/TLS handshake with your origin server. Start by testing the origin directly with SNI, then check the certificate, HTTPS listener, virtual-host configuration, TLS compatibility, firewall rules, and server logs.
Is Your Origin SSL Configuration Causing Connection Errors?
A missing certificate or an incomplete server installation can prevent Cloudflare from completing the origin handshake. Check the origin directly before replacing the certificate. If a new certificate is required, compare trusted SSL certificate options.
Related Posts:
