The short version
- 01As a visitor, wait — this is an SSL configuration problem at the site’s own server.
- 02If you own the site, verify a certificate is actually installed on the origin.
- 03Confirm port 443, or your custom secure port, is open and listening.
- 04Check SNI support is enabled at the origin.
- 05Compare the origin’s cipher suites against what Cloudflare offers.
- 06Install a free Cloudflare origin CA certificate if the origin has none.
Raw message
Error 525 — SSL handshake failed
Likely causes
- No valid SSL certificate installed on the origin server.
- Port 443, or the custom secure port, closed at the origin.
- SNI support not enabled at the origin.
- Cipher suites at the origin that do not match any Cloudflare offers.
- Full or Full (Strict) SSL mode selected without the origin being ready for it.
Why this one only appears in certain modes
Cloudflare defines 525 as an SSL handshake failure between Cloudflare and the origin web server, occurring when Full or Full (Strict) SSL mode is enabled. That condition is the most useful thing on the page, because it tells you when the error can and cannot happen.
Under Flexible mode Cloudflare talks to the origin over plain HTTP, so there is no handshake to fail. Switch to Full or Full (Strict) and Cloudflare begins requiring TLS to the origin — and an origin that was never set up for HTTPS starts refusing it.
That is why 525 so often appears immediately after someone changes the SSL/TLS mode in the dashboard. Nothing about the site broke; a stricter requirement was applied to an origin that could not meet it.
The four things Cloudflare asks you to verify
Cloudflare’s list for the origin is short and specific: a valid SSL certificate is installed, port 443 or the custom secure port is open, SNI support is enabled, and the cipher suites match between Cloudflare and the origin.
Each fails differently. No certificate is the common case on an origin that has only ever served plain HTTP. A closed port 443 produces the same error from a server that has a perfectly good certificate it is not offering. Missing SNI support matters on shared hosting, where the server needs the requested hostname to choose which certificate to present.
Cipher mismatch is the subtlest, and it tends to appear on older origins. Both ends have to agree on a cipher suite they will both use; an origin restricted to obsolete ciphers can be unable to find common ground even though its certificate is valid and its port is open.
Cloudflare suggests verifying the certificate with curl tests, and offers a free Cloudflare origin CA certificate for origins that need one.
Where the evidence is
The origin’s own SSL error logs are the fastest route to an answer, and Cloudflare says to check them at the timestamps when the 525 errors occurred. A TLS failure that Cloudflare can only describe as a handshake failure is usually explained precisely at the other end.
Cloudflare also points at Origin Analytics for identifying which endpoints are affected and correlating handshake failures with those logs. That matters when only part of a site fails, which points at one hostname or one server rather than the whole configuration.
For a visitor there is nothing to do. This is a configuration problem between two servers, and Cloudflare’s own advice is to wait for the site owner to resolve it at the origin.
Sources and review notes
Checked on . Based on Cloudflare’s support documentation for error 525. The Full and Full (Strict) condition, the four origin checks and the origin CA certificate suggestion are as published. The explanation of why the error appears right after an SSL mode change, and why SNI matters on shared hosting, are editorial. Glitchary is independent of Cloudflare.