SSL handshake failed

Updated 9 October 2026

Short answer

Before any secure page loads, the two sides perform a "handshake" to agree on encryption and check the certificate. "SSL handshake failed" means that negotiation broke down. On Cloudflare this shows as error 525 (handshake failed) or 526 (invalid certificate on your server). The usual causes are no certificate on your server, a certificate that doesn't match, or a server that only supports outdated encryption.

What's the problem

Visitors see "SSL handshake failed", "Error 525" or "Error 526" on a Cloudflare page, ERR_SSL_PROTOCOL_ERROR in Chrome, or an app or API call fails with a handshake error.

Why it happens

  • No certificate on your server while Cloudflare is set to connect over HTTPS (Full or Full strict).
  • An invalid certificate on your server (expired, self-signed, wrong name) with Full (strict) mode, which gives error 526.
  • Your server doesn't support the encryption Cloudflare or the browser needs, for example only very old TLS versions.
  • A firewall resets the connection during the handshake.
  • SNI not configured when several sites share one server.

How to fix it

  1. Check your server has a valid certificate for the domain. Cloudflare offers free "Origin CA" certificates for this.
  2. Match the Cloudflare SSL mode to your server: Full (strict) needs a valid certificate; Full accepts self-signed; never use Flexible if your server forces HTTPS.
  3. Enable modern TLS versions (1.2 and 1.3) on your server.
  4. Check your server's error logs at the time of the failures.
  5. Make sure port 443 isn't blocked for Cloudflare's IP addresses.

What Preventionlabs checks

One click runs the full report on your domain. For this problem it shows whether HTTPS works and http visitors are sent to it; every version of your address (http, https, www) and where each ends up, including redirect loops; insecure http:// files on any of up to 50 pages; your DNS: nameservers, addresses, DNSSEC, and records pointing at services that no longer exist. With Cloudflare connected, it also shows your certificate and the days until it expires; your SSL mode and the other settings that commonly cause this.

Run your free report

Your first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.

Sources

  1. Cloudflare: Error 525: SSL handshake failedofficial docsThis error indicates that the SSL handshake between Cloudflare and the origin web server failed.
  2. Cloudflare: Error 526: invalid SSL certificateofficial docsThis error indicates that Cloudflare is unable to verify the SSL certificate on your origin server, preventing a secure connection from being established.

Related

"Your connection is not private" The browser couldn't verify your site's certificate: it's expired, for the wrong domain, or not trusted. Fix or renew it on your server. HTTPS not working Usually no valid certificate, port 443 closed, or two redirect settings fighting. Check the certificate, then redirects and Cloudflare SSL mode. SSL certificate expired Renew the certificate on your server or hosting panel, then fix whatever stopped the automatic renewal so it doesn't happen again in 90 days. Cloudflare error: what it means and how to fix it A Cloudflare error page almost always means Cloudflare is fine but couldn't get a proper answer from your own server. The number says which part failed.
← All of SSL and HTTPS