Cloudflare error 525: SSL handshake failed
In Full or Full (strict) mode, Cloudflare connects to your origin over HTTPS, and the TLS handshake with the origin failed.
Where it failed: the origin behind Cloudflare
What visitors see
Cloudflare's "SSL handshake failed" page with a Ray ID.
Usual causes
- No certificate installed on the origin, or HTTPS not enabled on port 443.
- The origin only offers protocols or ciphers Cloudflare does not accept.
- The origin needs SNI and the configuration does not match the hostname.
How to tell which one it is
- Run openssl s_client -connect <origin IP>:443 -servername example.com to see whether the origin completes a handshake.
What to do
- Install a certificate on the origin (a free Cloudflare Origin CA certificate works in Full (strict) mode).
- Enable TLS 1.2 and 1.3 on the origin.
- Make sure the origin's virtual host answers for the hostname Cloudflare sends.
Check the site now
The Down Checker names the layer that failed (DNS, connection, TLS or the server) and decodes the error page it gets.
Free, no sign-up. Scan only sites you own or may test. 60 scans an hour per address.