The short version
- 01As a visitor, wait — this is a certificate problem between two servers.
- 02If you own the site, check the certificate is not expired or revoked.
- 03Confirm it is signed by a certificate authority rather than self-signed.
- 04Check the domain matches the Common Name or a Subject Alternative Name.
- 05Serve the complete chain, the leaf plus its intermediates, not just the leaf.
- 06Install a Cloudflare Origin CA certificate, or add a self-signed one to the trust store.
Raw message
Error 526 — Invalid SSL certificate
Likely causes
- A certificate at the origin that Cloudflare cannot validate.
- A self-signed certificate, which Full (Strict) will not accept by default.
- An expired or revoked certificate.
- A certificate whose names do not match the domain being requested.
- An incomplete chain, where the intermediates are not served alongside the leaf.
Reached, and refused
Cloudflare states that 526 indicates it is unable to verify the SSL certificate on your origin server, preventing a secure connection from being established. The important word is verify: Cloudflare got there, the origin presented a certificate, and Cloudflare declined to trust it.
That places it precisely against its neighbours. A 521 was refused outright, a 522 never connected, a 525 failed the handshake itself. A 526 got far enough to inspect the credentials and rejected them — which is a narrower and more fixable problem than any of those.
Cloudflare is explicit that this happens when Full SSL (Strict) is enabled. Strict is the mode that actually validates the origin’s certificate, which is why turning it on is the moment a long-standing certificate problem becomes visible.
What the origin’s certificate has to satisfy
Cloudflare lists what to verify with your hosting provider, and each item fails differently. The certificate must not be expired or revoked. It must be signed by a certificate authority rather than self-signed. The domain names must match its Common Name or a Subject Alternative Name. The complete chain must be served — the leaf plus its intermediates. And the server must accept connections on port 443.
The incomplete chain is the subtle one and the most common in practice. A server that sends only its leaf certificate works fine in browsers, because browsers cache intermediates they have seen before, and fails against Cloudflare, which does not have that history. The certificate is valid; the server is simply not proving it properly.
Cloudflare suggests testing with SSL Shopper or a similar tool after temporarily pausing Cloudflare, which lets you see what the origin presents without the proxy in the way.
The three ways out
Cloudflare offers a choice, and they are not equivalent. You can switch the SSL mode from Full (Strict) to Full, which stops the validation — traffic is still encrypted to the origin, but Cloudflare no longer checks who it is talking to. That clears the error immediately and gives up the protection the strict mode existed for, so it is a decision rather than a fix.
You can add a self-signed certificate to the Custom Origin Trust Store, which keeps strict validation while telling Cloudflare to trust your specific certificate. That is the right answer when the origin deliberately uses its own certificate.
Or you can install a Cloudflare Origin CA certificate, which is free, issued for exactly this purpose, and trusted by Cloudflare by design. For most sites hitting this error that is the cleanest of the three.
Sources and review notes
Checked on . Based on Cloudflare’s support documentation for error 526. The definition, the certificate checklist and the three remedies are as published. The contrast drawn with 520, 521, 522 and 525, and the explanation of why an incomplete chain works in browsers but not against Cloudflare, are editorial. Glitchary is independent of Cloudflare.