Fix Cloudflare error 526: invalid SSL certificate

For a proxied website using Full (strict), Cloudflare error 526 means Cloudflare could not validate the origin server's certificate. Check the origin's certificate chain, validity dates, and hostname coverage. Replacing the origin certificate or fixing its deployment addresses the cause; changing a visitor's browser does not.

Inspect the origin directly

Use the origin IP while retaining the website's hostname for SNI and certificate verification:

# Replace 192.0.2.10 with the actual origin IP.
curl -svo /dev/null --resolve example.com:443:192.0.2.10 https://example.com/

An expired or mismatched certificate requires correction on the origin. An issuer-trust error needs more interpretation: curl normally uses its own or the system's CA store, which generally does not trust Cloudflare Origin CA. A certificate accepted by Cloudflare can therefore fail this local test.

For an Origin CA certificate, obtain the appropriate root through Cloudflare's official documentation and pass it with --cacert. Do not infer that Cloudflare validation fails solely because a default local trust store rejects it. See Cloudflare's 526 troubleshooting.

Install a suitable origin certificate

One option is a Cloudflare Origin CA certificate. Create it under SSL/TLS → Origin Server, then install the certificate and private key in Nginx, Apache, or the actual TLS terminator. Cloudflare offers long-lived Origin CA certificates, with validity options up to 15 years; key protection and rotation still matter.

These certificates are intended for Cloudflare-to-origin traffic, not direct browser access. Restrict origin access appropriately, including the required Cloudflare address ranges and any explicitly authorized operational paths. Review Origin CA setup before choosing it.

Alternatively, install a publicly trusted certificate, such as one issued by Let's Encrypt. HTTP-01 can work through Cloudflare when its challenge request reaches the correct responder; proxying alone does not make it impossible. DNS-01 is an alternative when HTTP validation routing is unsuitable.

Understand a temporary change to Full

Changing Full (strict) to Full retains encryption to the origin but stops validating the origin certificate. Cloudflare documents this as a possible temporary recovery step. It weakens origin authentication and should have an explicit plan to restore strict validation after the certificate is repaired.

Flexible is a different mode: the edge-to-origin connection uses plain HTTP. It can also cause redirect loops when the origin insists on HTTPS. It is not a substitute for a working origin TLS deployment.

These modes involve two TLS endpoints. Even with Full (strict), the browser and origin do not share one uninterrupted TLS session through Cloudflare.

Verify the repaired service

Reload the origin service after a successful configuration check, then test both the origin and the public hostname. A Guance HTTP test can check the expected response through the CDN. Keep the origin certificate check separate: a certificate inspection of the public hostname usually sees the edge certificate.

Common questions

Why is an ordinary self-signed certificate rejected?

Encryption alone does not authenticate the origin. Full (strict) requires a certificate that meets Cloudflare's trust and identity checks, such as a publicly trusted certificate or an accepted Origin CA certificate.

Is this a browser problem?

For this website-proxy scenario, 526 is Cloudflare's response about the origin connection. Repair the origin configuration rather than asking visitors to bypass browser checks.

Why does 526 remain after replacing the certificate?

Confirm that the origin actually loaded the replacement and serves the right certificate for the name Cloudflare uses. Check all origin instances and any configured origin SNI/Host overrides. Network refusal or timeout belongs to a different diagnosis and more commonly produces errors such as 521 or 522.