Fix Cloudflare SSL Error 526: Invalid SSL Certificate
Cloudflare Error 526 means Cloudflare cannot validate the SSL certificate on your origin server. This happens when Cloudflare connects to your server in Full (strict) or Full SSL mode and the certificate on your origin is invalid, expired, or self-signed without being trusted.
Understanding Cloudflare SSL Modes
No SSL. HTTP everywhere. Never use this.
Cloudflare↔User: HTTPS. Cloudflare↔Origin: HTTP. No cert needed on origin.
Cloudflare↔Origin: HTTPS but does NOT validate cert. Self-signed OK.
Cloudflare↔Origin: HTTPS AND validates cert. Requires trusted or Cloudflare Origin CA cert.
Why Error 526 Occurs
Fix Option 1 — Use Cloudflare Origin CA Certificate (Recommended)
Cloudflare offers free Origin CA certificates trusted by Cloudflare's edge servers. This is the best approach for Full (Strict) mode:
- Go to Cloudflare Dashboard → SSL/TLS → Origin Server
- Click "Create Certificate" and choose RSA or ECC
- Copy the certificate and private key to your origin server
- Install them in your web server (Nginx/Apache)
- Also download the Cloudflare Origin CA root certificate and add it to your chain
Fix Option 2 — Install a Valid Public Certificate
If you want a certificate that also works without Cloudflare, use Let's Encrypt or another public CA:
# Install Certbot and get a Let's Encrypt certificate sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
Fix Option 3 — Downgrade to Full (Not Strict)
If you need a quick fix and have a self-signed certificate on origin, switch to Full mode (not strict) in the Cloudflare dashboard. This still encrypts traffic but does not validate the origin certificate. Upgrade to Full (Strict) once you have a valid cert.
Verify the Fix
Use our free Certificate Chain Checker on your origin's own hostname, not the proxied one, to inspect the origin certificate — its expiry, the chain it is sent with and the hostnames in its SANs.
Common questions
What causes Cloudflare SSL Error 526?
Error 526 means Cloudflare could not validate the SSL certificate on your origin server. Causes: the origin has a self-signed or expired certificate while Cloudflare is in Full (Strict) mode, the certificate Common Name or SAN does not match the origin hostname, or the origin is presenting a certificate issued by an untrusted CA.
How do I fix Cloudflare SSL error 526?
Install a valid CA-signed certificate on your origin server. Use a free Cloudflare Origin Certificate (15-year validity) or a Let's Encrypt certificate. If you must use a self-signed certificate, switch to Full (not Strict) SSL mode in Cloudflare — though Full (Strict) is always preferred for security.
What is the difference between Cloudflare Full and Full (Strict) SSL mode?
Full mode encrypts the Cloudflare-to-origin connection but does not validate the origin certificate — self-signed and expired certificates are accepted. Full (Strict) validates the certificate against a trusted CA. Always use Full (Strict) in production to prevent man-in-the-middle attacks between Cloudflare and your origin server.
Can Cloudflare cause SSL errors on sites with valid certificates?
Yes. Cloudflare terminates SSL from visitors and makes a separate connection to your origin. If the SSL/TLS mode is misconfigured — Flexible when origin requires HTTPS, or Full (Strict) with an expired origin certificate — visitors see 5xx errors. Always check both the origin certificate validity and Cloudflare's SSL/TLS settings together.
References and further reading
The specifications and primary documentation this article is based on.
Read next
More guides on the same subject.