Error 526 occurs specifically when Cloudflare's SSL mode is set to Full (Strict) and the origin server's SSL certificate fails validation. The TLS handshake may succeed (unlike 525), but the certificate does not pass Cloudflare's validation checks — it may be expired, self-signed, not issued for the correct hostname, or have an incomplete certificate chain. This error only occurs in Full (Strict) mode because other modes do not validate the origin certificate.
The origin's certificate has passed its expiration date. Let's Encrypt certificates expire every 90 days and auto-renewal sometimes fails silently.
Full (Strict) mode requires a certificate signed by a trusted CA or Cloudflare's Origin CA. A standard self-signed certificate will be rejected.
The certificate's Common Name (CN) or Subject Alternative Names (SANs) do not include the domain being requested through Cloudflare.
The origin is only serving the leaf certificate without the required intermediate certificates, so Cloudflare cannot build a chain to a trusted root.
Connect to the origin and inspect the certificate details to ensure it is valid and not expired.
echo | openssl s_client -connect YOUR_ORIGIN_IP:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates -issuer -subject
Check that the certificate's Subject Alternative Names (SANs) include your domain name.
echo | openssl s_client -connect YOUR_ORIGIN_IP:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -ext subjectAltName
Generate a free Origin CA certificate from the Cloudflare dashboard (SSL/TLS > Origin Server). These are trusted by Cloudflare in Full (Strict) mode and last up to 15 years.
The origin must serve the leaf certificate plus all intermediate certificates. Check with openssl or an online SSL checker.
openssl s_client -connect YOUR_ORIGIN_IP:443 -servername yourdomain.com -showcerts 2>/dev/null
If you need the site online immediately, switch from Full (Strict) to Full. This still uses HTTPS to the origin but does not validate the certificate. Fix the certificate and switch back.
Cloudflare could not negotiate an SSL/TLS connection with the origin server.
The origin web server refused or is not accepting connections from Cloudflare.
Cloudflare received an empty, unknown, or unexpected response from the origin server.