525 SSL Handshake Failed

The TLS handshake between Cloudflare and the origin failed.

Status

HTTP/1.1 525 SSL Handshake Failed

Details

Category: 5xx
Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

525 means Cloudflare reached the origin but could not agree on TLS. Common causes are no valid certificate on the origin, no cipher suite in common, or the origin not serving TLS on port 443 at all while Cloudflare is configured for Full SSL mode.

It is a configuration mismatch between the edge SSL mode and what the origin actually supports.

Common causes

The origin has no TLS certificate installed, or it has expired.
SSL mode set to Full or Full (strict) while the origin serves plaintext only.
No shared cipher suite or protocol version between edge and origin.
SNI misconfiguration on the origin so the wrong certificate is presented.

How to fix it

As the client

Nothing on the client side. The failure is between the edge and the origin.

As the server

Install a valid certificate on the origin, or use an origin certificate issued by the CDN.
Match the SSL mode to what the origin supports rather than forcing Full strict against a plaintext origin.
Test directly with openssl s_client -connect origin:443 -servername www.example.com.

Examples

GET / HTTP/1.1
Host: www.example.com

HTTP/1.1 525
Server: cloudflare