Cloudflare Error 525 (SSL Handshake Failed): Causes and How to Fix It
Quick Answer
Cloudflare Error 525 (SSL Handshake Failed) occurs when the TLS/SSL handshake between Cloudflare and your origin web server fails while your zone is configured to use Full or Full (strict) encryption mode. This error indicates that Cloudflare reached your origin network over HTTPS but could not successfully complete TLS negotiation before exchanging HTTP traffic.
Troubleshoot the origin server before altering Cloudflare configurations. Confirm that an SSL/TLS certificate is installed on the origin, port 443 (or your custom secure origin port) is open and listening, Server Name Indication (SNI) is supported, your server's cipher suites match Cloudflare's requirements, and origin firewalls or load balancers are not resetting TLS connections.
Understanding Error 525
When Cloudflare proxies HTTPS traffic, two independent connections are established: visitor to Cloudflare, and Cloudflare to the origin server. Error 525 occurs strictly on the second leg. Cloudflare initiates a TLS connection to your origin IP address on a secure port, but the origin drops, rejects, or fails to complete the TLS handshake.
Cloudflare documentation identifies four primary origin-side causes for Error 525:
- No valid SSL/TLS certificate is installed on the origin server.
- Port 443 (or another designated secure origin port) is closed or blocked.
- The origin server lacks Server Name Indication (SNI) support.
- The cipher suites accepted or presented by Cloudflare do not match the cipher suites supported by the origin web server.
If you have access to Cloudflare Origin Analytics, review the Origin status codes chart. An originResponseStatus of 0 indicates that Cloudflare received no HTTP response from your origin, which often signals TLS negotiation failures when it aligns with Error 525 occurrences.
Error 525 vs Error 526
Understanding the distinction between Error 525 and Error 526 prevents misdirected troubleshooting:
| Status Code | Condition | Root Cause |
|---|---|---|
| Error 525 | TLS handshake failed | The TLS negotiation between Cloudflare and the origin was never completed due to port, cipher, SNI, or connection reset issues. |
| Error 526 | Invalid SSL certificate | The TLS handshake established, but Cloudflare was unable to validate the origin certificate under Full (strict) mode (e.g., expired, self-signed, or hostname mismatch). |
Under standard Full mode, Cloudflare does not validate origin certificate authenticity and accepts self-signed or expired certificates as long as a TLS handshake completes. If certificate validation fails in Full (strict) mode, Cloudflare issues an Error 526 rather than a 525.
Diagnostic Steps
1. Check SSL/TLS Mode in Cloudflare
Log in to your Cloudflare dashboard, navigate to SSL/TLS > Overview, and check the encryption mode. Error 525 only appears when the mode is set to Full or Full (strict). Do not downgrade to Flexible as a permanent solution; investigate why the origin cannot complete HTTPS handshakes.
2. Test Origin Connectivity Directly
Cloudflare recommends using cURL to connect directly to the origin web server's IP address while preserving the requested domain hostname. Run the following command from your terminal, replacing example.com with your domain and 192.0.2.1 with your origin IP address:
curl -svo /dev/null https://example.com --connect-to ::192.0.2.1Inspect the verbose output for:
- Connection resets or drops during the TLS handshake.
- The TLS version and cipher suite selected by the origin.
- The certificate presented by the origin server.
Note: If you use a free Cloudflare Origin CA certificate on your origin, direct testing tools or browsers will flag the certificate as untrusted by a public root authority. This is normal behavior, as Origin CA certificates are trusted exclusively by Cloudflare's proxy network.
3. Check Origin Server Error Logs
If Error 525 occurs intermittently, match the error timestamps with your origin web server logs to locate connection drops during the TLS handshake:
- Nginx: Inspect the standard error log (e.g.,
/var/log/nginx/error.log). You may temporarily raise the log level to capture deeper SSL handshake diagnostics. - Apache: Inspect your error log and ensure that
mod_sslerror logging is enabled.
How to Fix Error 525
Step 1: Install a Valid Origin Certificate
Ensure your web server has a functional TLS certificate installed and bound to the HTTPS port. You can use a certificate from a public Certificate Authority (such as Let's Encrypt) or generate a free Cloudflare Origin CA certificate from SSL/TLS > Origin Server in the Cloudflare dashboard.
When installing a Cloudflare Origin CA certificate, verify that your DNS records remain proxied (orange cloud) in Cloudflare, as direct visitors will encounter trust errors otherwise.
Step 2: Ensure Port 443 is Open and Listening
Verify that your origin server is actively listening for incoming HTTPS requests on port 443 (or your custom HTTPS port) and that external firewalls permit traffic from Cloudflare's IP addresses. Check socket status on Linux using:
sudo ss -tulpn | grep :443Ensure that cloud security groups (e.g., AWS Security Groups, Google Cloud Firewall) and server firewalls (e.g., UFW, iptables) permit inbound connections to port 443 from all published Cloudflare IP address ranges.
Step 3: Verify SNI and Virtual Host Configuration
If your web server hosts multiple sites on a single IP address, ensure that the HTTPS virtual host configuration properly responds to the Server Name Indication (SNI) header sent by Cloudflare during the handshake.
Step 4: Resolve Cipher Suite Incompatibilities
Ensure your web server's TLS configuration supports modern, standard cipher suites compatible with Cloudflare. If your server is configured with an overly restrictive cipher policy or deprecated TLS protocol versions, the TLS handshake will fail before completion.
Step 5: Address Server Overload and Handshake Resets
Intermittent 525 errors often occur when origin servers, load balancers, or security appliances reset TCP/TLS connections under heavy load or strict rate-limiting rules. Review origin resource utilization (CPU, memory, connection limits) and ensure security software does not flag Cloudflare's proxied IP addresses as abusive traffic.
Verification Checklist
- Cloudflare SSL/TLS encryption mode is set to Full or Full (strict).
- Origin server is listening on port 443 (or configured custom secure port).
- Valid certificate (Public CA or Cloudflare Origin CA) is active on the origin.
- Direct cURL test (
--connect-to) successfully completes TLS negotiation. - All Cloudflare IP ranges are allowed through origin firewalls and security groups.
- Origin logs show clean TLS handshakes without connection reset entries.
For related troubleshooting, see our guide on Cloudflare Error 521 (Web Server Is Down).
