526 Invalid SSL Certificate

The origin presented a TLS certificate that could not be validated.

Status

HTTP/1.1 526 Invalid SSL Certificate

Details

Category: 5xx
Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

526 appears with Full (strict) SSL mode, where the origin certificate must be valid and trusted. A self-signed, expired, or hostname-mismatched certificate produces 526 even though the handshake itself could technically proceed.

The difference from 525 is that the handshake failed outright there, while here it is validation that failed.

Common causes

A self-signed certificate on the origin under Full (strict) mode.
An expired origin certificate.
A certificate whose common name or SAN entries do not cover the hostname.
A missing intermediate certificate, so the chain cannot be built.

How to fix it

As the client

Nothing on the client side. The certificate problem is at the origin.

As the server

Install a publicly trusted certificate, or a CDN-issued origin certificate, and include the full chain.
Automate renewal. Expired origin certificates are the most common cause.
Check hostname coverage with openssl x509 -noout -text and confirm the SAN list.

Examples

GET / HTTP/1.1
Host: www.example.com

HTTP/1.1 526
Server: cloudflare