Cloudflare: Error 526: Invalid SSL certificate
Last verified
Error 526: Invalid SSL certificateWhat it means
526 means the zone's SSL/TLS mode is Full (strict) and Cloudflare could not validate the certificate the origin presented. The handshake can complete, but the certificate fails strict checks, so Cloudflare refuses to proceed.
For visitors and automation, nothing on your side is wrong; the site's origin certificate needs attention.
For the site owner, Cloudflare's checklist is: the certificate is not expired, not revoked, signed by a certificate authority (not self-signed, unless it is a Cloudflare Origin CA certificate or added to the Custom Origin Trust Store), covers the hostname in its Common Name or Subject Alternative Name, has a complete chain, and is served on port 443. Switching to Full (non-strict) is a quick workaround but does not fix the certificate.
What it looks like
$ openssl s_client -connect ORIGIN_IP:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates -subjectWhy it happens
- The origin certificate has expired.
- The certificate is self-signed and not in the Custom Origin Trust Store.
- The certificate does not cover the requested hostname.
- The intermediate chain is incomplete.
- The certificate was revoked.
How to fix it
- Visitors and automation: retry later; report the Ray ID to the site.
- Site owners: check expiry, hostname coverage and chain with an SSL checker against the origin directly.
- Install a Cloudflare Origin CA certificate or a publicly trusted certificate on the origin.
- If you must use a self-signed certificate, add it to the Custom Origin Trust Store.
- Only switch to Full (non-strict) temporarily while fixing the certificate.
How to stop it recurring
Site owners: automate renewals, alert on certificates nearing expiry, and keep the full chain configured. A Cloudflare Origin CA certificate can be issued with a long validity, which removes most expiry-driven 526s. Client-side certificate errors are a different problem, covered in CERTIFICATE_VERIFY_FAILED.
Official documentation: developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-526. See all Cloudflare error messages.
Related errors
Definitions
- CAPTCHACAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response m
- Cloudflare Bot ManagementCloudflare Bot Management is the set of Cloudflare features (Bot Fight Mode, Super Bot Fight Mode and the Ente
- Cloudflare TurnstileCloudflare Turnstile is Cloudflare's free CAPTCHA replacement: a widget that runs invisible browser checks, is
- User AgentA user agent is a string that browsers send with every HTTP request identifying the browser type, version, and
- Rate LimitingRate limiting is a technique that controls the number of requests a client can make to a server within a given
Quick answers
What does "Error 526: Invalid SSL certificate" mean in Cloudflare?
526 means the zone's SSL/TLS mode is Full (strict) and Cloudflare could not validate the certificate the origin presented. The handshake can complete, but the certificate fails strict checks, so Cloudflare refuses to proceed. For visitors and automation, nothing on your side is wrong; the site's origin certificate needs attention.
How do I fix "Error 526: Invalid SSL certificate"?
1. Visitors and automation: retry later; report the Ray ID to the site. 2. Site owners: check expiry, hostname coverage and chain with an SSL checker against the origin directly. 3. Install a Cloudflare Origin CA certificate or a publicly trusted certificate on the origin. 4. If you must use a self-signed certificate, add it to the Custom Origin Trust Store. 5. Only switch to Full (non-strict) temporarily while fixing the certificate.
Retries and timeouts without writing the loop
Autonoly's HTTP Request node and browser steps have per-node retries, timeouts and continue-on-fail, so a transient 429 or 503 can back off instead of failing the run. It has no proxies or IP rotation: if a site blocks automated traffic, that block applies to Autonoly too.
Also see Error handling in workflows.