Cloudflare Error 526: Fix Invalid SSL Cert

Error 526 means Cloudflare tried to check the SSL certificate on your own server (the "origin") and the check failed, so the fix is to install a valid certificate on the origin or, as a short-term stopgap, change Cloudflare's SSL mode.

This post is for site owners who see "Invalid SSL certificate, Error code 526" on a site that sits behind Cloudflare. You do not need to be a server expert. You will learn what the error means, how to find the exact cause with two commands, how to pick the right SSL mode, and how to install or renew the certificate and confirm it works.

What is invalid SSL certificate error code 526?

A site behind Cloudflare has two encrypted connections. One runs from your visitor to Cloudflare. The other runs from Cloudflare to your origin server (the machine at your host that actually holds your site).

Error 526 is about the second connection. In Full (strict) SSL mode, Cloudflare checks the origin's certificate before it passes any traffic. If the certificate fails the check, Cloudflare shows visitors a 526 page instead of your site. Cloudflare describes this in its Error 526 documentation.

The certificate has to pass these checks:

• It has not expired.
• It covers the hostname being requested (for example www.example.com).
• It was issued by a certificate authority (CA, a company browsers trust to vouch for sites) that Cloudflare trusts, or by Cloudflare's own Origin CA.
• The server sends the full chain, including intermediate certificates.
• It has not been revoked.

A related error, 525, means the secure handshake itself failed. With 526 the handshake works, but the certificate is not acceptable.

The usual causes

Most 526 errors come from a short list:

• Expired certificate. Auto-renewal broke and nobody noticed.
• Self-signed certificate. The server made its own certificate. This is common on fresh VPS installs and some hosting defaults.
• Name mismatch. The certificate covers example.com but not www.example.com, or a new subdomain was never added.
• Missing intermediate certificate. The server sends only the leaf certificate, not the full chain.
• Wrong virtual host. A server with many sites hands out the default site's certificate for your hostname.
• Certificate swapped or removed. A host migration, a panel update or a new plan reset the SSL setup.

Step 1: Check the certificate your origin really serves

Do not guess. Ask the origin directly. You need its real IP address, which is in your hosting dashboard. If your DNS record is proxied (orange cloud), the IP you see in public DNS belongs to Cloudflare, not to your server.

Run this from your own computer, replacing ORIGIN_IP and example.com:

echo | openssl s_client -connect ORIGIN_IP:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

The -ext option needs OpenSSL 1.1.1 or newer. Older systems, and the LibreSSL that macOS ships by default, may fail with an error. If that happens, use this version instead. It prints the full certificate text, so look for the Issuer, Not After, Subject and Subject Alternative Name lines:

echo | openssl s_client -connect ORIGIN_IP:443 -servername example.com 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

If the command hangs or times out, your host's firewall may only allow Cloudflare's IP ranges. In that case, run the same command from the server itself against 127.0.0.1, or ask your host to run it for you.

Read the output like this:

• notAfter is the expiry date. If it is in the past, you have found the problem.
• issuer and subject are the same? It is self-signed.
• subjectAltName lists the hostnames covered. Yours must be in that list (or match a wildcard like *.example.com).

Now check the chain:

echo | openssl s_client -connect ORIGIN_IP:443 -servername example.com 2>/dev/null | grep -E "Verify return code"

Verify return code: 0 (ok) means a normal publicly trusted certificate with a complete chain. Codes such as 18 or 19 (self-signed), 20 or 21 (missing issuer or intermediate) and 10 (expired) point to the cause.

One exception: a Cloudflare Origin CA certificate will not return 0 (ok) here, because only Cloudflare trusts it. If the issuer mentions Cloudflare Origin CA and the dates and names are right, that certificate is fine for Full (strict).

Step 2: Choose between Full and Full (strict)

In the Cloudflare dashboard, go to SSL/TLS > Overview and look at your encryption mode. Cloudflare explains each one in its SSL/TLS encryption modes guide.

Here is the honest tradeoff. Switching from Full (strict) to Full will make the 526 disappear fast, and the connection stays encrypted. But Cloudflare no longer confirms it is talking to your real server, so the encryption protects less. Use Full to get the site back while you work, then fix the certificate and go back to Full (strict).

Do not "fix" 526 by choosing Flexible. It hides the error by removing encryption between Cloudflare and your server.

Step 3: Install or renew the certificate

Pick the option that matches your setup.

Option A: A free public certificate with Let's Encrypt (Linux server)

If you manage your own server, Certbot is the standard tool. First see what you have:

sudo certbot certificates
sudo certbot renew --dry-run

If the dry run fails, read its error. Common reasons are a stopped renewal timer, a changed web server config, or a blocked validation path. To get or reissue a certificate for nginx covering both names:

sudo certbot --nginx -d example.com -d www.example.com

Then test the config and reload:

sudo nginx -t && sudo systemctl reload nginx

Make sure your web server points at fullchain.pem (leaf plus intermediates), not cert.pem alone. That one setting fixes many "missing intermediate" cases. Certbot's default HTTP validation usually works behind Cloudflare. If it does not, use the DNS challenge instead.

Option B: A Cloudflare Origin CA certificate

Cloudflare can issue a certificate that only Cloudflare trusts. It is designed for exactly this connection, and it is free. Details are in the Origin CA documentation.

1. Go to SSL/TLS > Origin Server > Create Certificate.
2. List every hostname you need, such as example.com and *.example.com.
3. Pick a validity period, then copy the certificate and the private key.
4. Save them on your server and point your web server config at both files.
5. Reload the web server.

Two warnings. Keep the private key secret and never email or paste it into a chat. Also, this certificate only works while the DNS record is proxied (orange cloud). If you turn the proxy off, browsers will show a certificate warning.

Option C: Shared hosting or a managed panel

You often cannot touch the server config. Look in your host's panel instead:

• cPanel: SSL/TLS Status, then Run AutoSSL.
• Plesk: the Let's Encrypt extension or the SSL/TLS Certificates page.
• Other hosts: find the "SSL" or "HTTPS" page and reissue the certificate for the exact hostname.

If that fails, ask support: "Cloudflare returns error 526 in Full (strict) mode. Please install a valid certificate that covers example.com and www.example.com, with the full chain." That sentence gives them what they need.

Step 4: Re-test

Do not trust a single browser refresh. Check these:

1. Re-run the two openssl commands from Step 1. Dates should be in the future and names should match.
2. Test through Cloudflare:

curl -sI https://example.com | head -n 1
curl -sI https://www.example.com | head -n 1

You want HTTP/2 200 or a normal redirect such as 301, not 526.

1. Open the site in a private window to avoid cached results.
2. Confirm the mode is Full (strict) again if you changed it.
3. Set a reminder or monitor for the certificate expiry date, so this does not return when the certificate expires (Let's Encrypt certificates last about 90 days).

Cause versus fix at a glance

A valid certificate is only one piece

Fixing 526 gets your site back with an encrypted connection between Cloudflare and your server. It does not tell you whether the rest of the site is safe. Missing security headers, outdated plugins and exposed admin pages are separate issues. You can run a quick look at your headers with the security headers tool, or read how to tell if your website is hackable to see what attackers check first.

Key takeaways

• Error 526 means Cloudflare could not validate the certificate on your origin in Full (strict) mode.
• Use openssl s_client against the origin IP to see the expiry date, issuer, hostnames and chain before changing anything.
• Fix the certificate (Let's Encrypt, Cloudflare Origin CA, or your host's panel) and keep Full (strict). Treat Full as a temporary stopgap.
• Never use Flexible to hide the error, because it sends traffic to your server unencrypted.
• Re-test every hostname and set an expiry reminder so it does not repeat.

Want a human to look at the rest?

A working certificate is a good start, but it is one item on a long list. If you want a person to hand-check your whole site and give you a written report with exact fixes, the Circuit audit is $49 one-time. You can also start with the free website security check, no card needed. Neither is a compliance certification. It is a practical manual review built for small sites.