Cloudflare error 526: invalid SSL certificate
In Full (strict) mode Cloudflare checks the origin's certificate, and it failed: expired, self-signed, or not valid for this hostname.
Where it failed: the origin behind Cloudflare
What visitors see
Cloudflare's "Invalid SSL certificate" page with a Ray ID.
Usual causes
- The origin's certificate expired (renewal stopped).
- A self-signed certificate on the origin.
- A certificate for another name, or one missing the hostname.
How to tell which one it is
- Check the origin certificate with openssl s_client -connect <origin IP>:443 -servername example.com and read its dates and names.
What to do
- Renew the origin certificate, or install a Cloudflare Origin CA certificate (valid up to 15 years for Cloudflare's checks).
- Do not switch the mode to Flexible to hide it: Flexible sends traffic from Cloudflare to your origin unencrypted.
Check the site now
The Down Checker names the layer that failed (DNS, connection, TLS or the server) and decodes the error page it gets.
Free, no sign-up. Scan only sites you own or may test. 60 scans an hour per address.