Error guide / Cloudflare Error 526: Invalid SSL certificate
Cloudflare Error 526: Invalid SSL certificate
Error 526 comes from Cloudflare, not from your site. It appears when Cloudflare is set to the Full (strict) encryption mode and cannot validate the certificate your origin server presents, so it refuses to pass the request through. Visitors get a Cloudflare screen saying Invalid SSL certificate, and the site does not load for anyone. The certificate browsers see at Cloudflare's edge is fine, which is why the domain looks healthy in an ordinary SSL test; the broken link is one hop further back, between Cloudflare and your server.
Check your site
What causes it
Cloudflare checks four things about the origin certificate, and 526 means one of them failed. Most often the certificate has expired, usually because an automatic renewal quietly stopped working. Next most common is a name mismatch, where the origin presents a certificate that does not cover the requested domain, which is typical of a default shared hosting certificate; after that come self-signed certificates or ones from a CA that Cloudflare does not trust, and incomplete chains where the server sends the leaf certificate but omits the intermediate. In many cases nothing changed on the server at all, and the real trigger was switching the encryption mode to Full (strict), which turned a long-standing origin problem into a hard failure.
How to fix it
- Point the check at your origin, not at the proxied domain: use a DNS-only (grey cloud) subdomain such as origin.example.com, or the server hostname your host gave you, and run the SSL check on this page against it. Read five lines in the result: the validity dates, days left, the issuer, the list of names the certificate covers, and the chain the server sent. Those five lines are exactly what Cloudflare validates in Full (strict) mode, while the proxied domain shows only Cloudflare's edge certificate, which is always valid and proves nothing.
- If days left is negative or the certificate is marked expired, that is your cause: renew it on the origin and fix whatever broke the renewal, usually a cron job that no longer runs or an ACME validation that now fails because Cloudflare returns 526 for the challenge request too.
- If the issuer is the server's own name or matches the subject, the certificate is self-signed and Full (strict) will always reject it; if the issuer is a real certificate authority but the check still marks the certificate as untrusted and shows a single certificate in the chain, the intermediate is missing, so install the CA bundle alongside the certificate and reload the web server.
- If dates and issuer look fine, read the list of covered names: your domain and its www form have to be there. A default hosting certificate issued for a server name like server42.hostingcompany.com does not cover your domain, and that mismatch alone produces 526. Issue a certificate for your real domain and bind it to that site in your hosting control panel.
- Install a certificate that passes all four checks: a free Let's Encrypt or ZeroSSL certificate from your hosting control panel, or a Cloudflare Origin CA certificate (free, valid up to 15 years, accepted by Full (strict), but only for traffic coming from Cloudflare). Re-run the check against the origin until dates, issuer, names and chain are all clean.
- Switch the encryption mode from Full (strict) to Full only as a deliberate, understood downgrade: Full still encrypts the hop between Cloudflare and the origin, but it does not verify the certificate at all, so an expired, self-signed or forged one is accepted and interception on that hop goes unnoticed. It is reasonable as a short-term measure, for example to let a certificate renewal through, and you should switch back to Full (strict) as soon as the check is clean.