Cloudflare: Error 525: SSL handshake failed
Last verified
Error 525: SSL handshake failedWhat it means
525 means the TLS handshake between Cloudflare and the origin failed. It only occurs when the zone's SSL/TLS mode is Full or Full (strict), because those modes make Cloudflare connect to the origin over HTTPS. The visitor's connection to Cloudflare is fine; the second leg is broken.
For visitors and automation, there is nothing to fix on your side, and disabling certificate checks in your client will not help.
For the site owner, Cloudflare asks you to rule out: no valid certificate installed on the origin, port 443 (or the custom secure port) not open, no SNI support, and cipher suites that do not overlap with Cloudflare's.
What it looks like
$ openssl s_client -connect ORIGIN_IP:443 -servername example.comWhy it happens
- No SSL certificate installed on the origin.
- Port 443 closed or not serving TLS.
- The origin does not support SNI.
- No cipher suites in common between the origin and Cloudflare.
How to fix it
- Visitors and automation: retry later and report the Ray ID to the site.
- Site owners: confirm a certificate is installed on the origin; Cloudflare's free Origin CA certificate is an option.
- Check that port 443 is open and serving TLS with SNI.
- Review the origin's cipher suites against Cloudflare's supported list.
- For intermittent 525s, check the origin's SSL error logs at the times of failure.
How to stop it recurring
Site owners: automate certificate installation and renewal on the origin, keep TLS configuration modern, and test the origin directly after any server or certificate change. Before switching a zone from Flexible to Full or Full (strict), confirm the origin already serves HTTPS on port 443, because that switch is the most common moment 525 appears.
Official documentation: developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-525. See all Cloudflare error messages.
Related errors
Definitions
- CAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response m
- Cloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Ente
- Cloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, is
- User AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and
- Rate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given
Quick answers
What does "Error 525: SSL handshake failed" mean in Cloudflare?
525 means the TLS handshake between Cloudflare and the origin failed. It only occurs when the zone's SSL/TLS mode is Full or Full (strict), because those modes make Cloudflare connect to the origin over HTTPS. The visitor's connection to Cloudflare is fine; the second leg is broken. For visitors and automation, there is nothing to fix on your side, and disabling certificate checks in your client will not help.
How do I fix "Error 525: SSL handshake failed"?
1. Visitors and automation: retry later and report the Ray ID to the site. 2. Site owners: confirm a certificate is installed on the origin; Cloudflare's free Origin CA certificate is an option. 3. Check that port 443 is open and serving TLS with SNI. 4. Review the origin's cipher suites against Cloudflare's supported list. 5. For intermittent 525s, check the origin's SSL error logs at the times of failure.
Retries and timeouts without writing the loop
Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.
Also see Error handling in workflows.