Cloudflare Error 525: SSL Handshake Failed

How to fix it

Try these in order — the most common fix is first.

1. 1. Install a certificate on the origin

   Copy steps
   1. Generate a free Cloudflare Origin CA certificate under SSL/TLS > Origin Server
   2. Install it in nginx/Apache and reload
   Did this fix it? Yes No

2. 2. Open port 443

   Copy steps
   1. Check the host firewall and cloud security group allow inbound 443
   2. Test with openssl s_client -connect <origin-ip>:443 -servername <domain>
   Did this fix it? Yes No

3. 3. Read the error logs

   Copy steps
   1. Check Apache mod_ssl or nginx error logs at the time of the error
   2. Look for resets during the handshake
   Did this fix it? Yes No

4. 4. Temporary workaround

   1. Set SSL/TLS mode to Flexible only to restore the site briefly, then fix the origin (Flexible is not encrypted to your origin)
   Did this fix it? Yes No

Symptoms

'Error 525 SSL handshake failed' appears on a proxied site; it often starts right after changing SSL mode or moving hosts.

Why it happens

• No SSL certificate installed on the origin
• Port 443 closed or blocked
• Origin does not support SNI
• Cipher suite mismatch with Cloudflare
• Authenticated Origin Pulls misconfigured

This guide also covers

• cloudflare error 525
• ssl handshake failed cloudflare
• 525 cloudflare nginx

Other Cloudflare errors

• Cloudflare Error 521: Web Server Is Down
• Cloudflare Error 522: Connection Timed Out
• Cloudflare Error 524: A Timeout Occurred
• Cloudflare Error 526: Invalid SSL Certificate
• Cloudflare Error 520: Web Server Returned an Unknown Error
• Cloudflare Error 1020: Access Denied
• Cloudflare Error 1015: You Are Being Rate Limited
• Cloudflare Error 1016: Origin DNS Error