What causes Cloudflare SSL Error 526?

Error 526 means Cloudflare could not validate the SSL certificate on your origin server. Causes: the origin has a self-signed or expired certificate while Cloudflare is in Full (Strict) mode, the certificate Common Name or SAN does not match the origin hostname, or the origin is presenting a certificate issued by an untrusted CA.

How do I fix Cloudflare SSL error 526?

Install a valid CA-signed certificate on your origin server. Use a free Cloudflare Origin Certificate (15-year validity) or a Let's Encrypt certificate. If you must use a self-signed certificate, switch to Full (not Strict) SSL mode in Cloudflare — though Full (Strict) is always preferred for security.

What is the difference between Cloudflare Full and Full (Strict) SSL mode?

Full mode encrypts the Cloudflare-to-origin connection but does not validate the origin certificate — self-signed and expired certificates are accepted. Full (Strict) validates the certificate against a trusted CA. Always use Full (Strict) in production to prevent man-in-the-middle attacks between Cloudflare and your origin server.

Can Cloudflare cause SSL errors on sites with valid certificates?

Yes. Cloudflare terminates SSL from visitors and makes a separate connection to your origin. If the SSL/TLS mode is misconfigured — Flexible when origin requires HTTPS, or Full (Strict) with an expired origin certificate — visitors see 5xx errors. Always check both the origin certificate validity and Cloudflare's SSL/TLS settings together.

Back to Learning Center

Error Fix

Fix Cloudflare SSL Error 526: Invalid SSL Certificate

5 min read·Updated June 2026·By CertNotify Team

Cloudflare Error 526 means Cloudflare cannot validate the SSL certificate on your origin server. This happens when Cloudflare connects to your server in Full (strict) or Full SSL mode and the certificate on your origin is invalid, expired, or self-signed without being trusted.

Understanding Cloudflare SSL Modes

Off

No SSL. HTTP everywhere. Never use this.

Flexible

Cloudflare↔User: HTTPS. Cloudflare↔Origin: HTTP. No cert needed on origin.

Full

Cloudflare↔Origin: HTTPS but does NOT validate cert. Self-signed OK.

Full (Strict)

Cloudflare↔Origin: HTTPS AND validates cert. Requires trusted or Cloudflare Origin CA cert.

Why Error 526 Occurs

You are using Full (Strict) mode but origin has a self-signed certificate

Origin SSL certificate has expired

Origin SSL certificate was issued for a different hostname

Certificate chain is incomplete (missing intermediate CA)

Origin does not have an SSL certificate at all

You recently switched to Full (Strict) from another mode

Fix Option 1 — Use Cloudflare Origin CA Certificate (Recommended)

Cloudflare offers free Origin CA certificates trusted by Cloudflare's edge servers. This is the best approach for Full (Strict) mode:

Go to Cloudflare Dashboard → SSL/TLS → Origin Server
Click "Create Certificate" and choose RSA or ECC
Copy the certificate and private key to your origin server
Install them in your web server (Nginx/Apache)
Also download the Cloudflare Origin CA root certificate and add it to your chain

Fix Option 2 — Install a Valid Public Certificate

If you want a certificate that also works without Cloudflare, use Let's Encrypt or another public CA:

# Install Certbot and get a Let's Encrypt certificate
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Fix Option 3 — Downgrade to Full (Not Strict)

If you need a quick fix and have a self-signed certificate on origin, switch to Full mode (not strict) in the Cloudflare dashboard. This still encrypts traffic but does not validate the origin certificate. Upgrade to Full (Strict) once you have a valid cert.

Full (Strict) + Cloudflare Origin CA = Best practice

Full (Strict) + Let's Encrypt = Also excellent

Full (not Strict) = Better than Flexible, but no cert validation

Flexible = Origin traffic is unencrypted

Verify the Fix

Wait 2–5 minutes after changes for Cloudflare cache to clear

Check the Cloudflare SSL/TLS tab — it should show "Active" status

Visit your domain — the padlock should appear in the browser

Run our SSL Checker tool to confirm certificate validity

Use our free SSL Certificate Checker to inspect your origin certificate directly — verifying validity, expiry, and whether the hostname matches your certificate's SANs.