Cloudflare Error 526: Invalid SSL Certificate

How to fix it

Try these in order — the most common fix is first.

1. 1. Quick stopgap

   Copy steps
   1. Go to SSL/TLS > Overview
   2. Change Full (strict) to Full (accepts self-signed, still encrypted)
   Did this fix it? Yes No

2. 2. Install a valid origin certificate

   Copy steps
   1. Create a Cloudflare Origin CA certificate in SSL/TLS > Origin Server and install it with its key
   2. Or use a Let's Encrypt certificate
   Did this fix it? Yes No

3. 3. Check the certificate

   Copy steps
   1. Verify not expired, name matches via CN/SAN, and full chain served
   2. Pause Cloudflare briefly and run the hostname through an external SSL checker
   Did this fix it? Yes No

4. 4. Workers subrequests

   Copy steps
   1. Subrequests to non-proxied hosts always use Full (strict)
   2. Add self-signed certs to the Custom Origin Trust Store and enable cots_on_external_fetch
   Did this fix it? Yes No

Symptoms

'Error 526 Invalid SSL certificate' on a site using Full (strict).

Why it happens

• Origin certificate expired or revoked
• Self-signed certificate under Full (strict)
• Certificate name does not match the hostname
• Missing intermediate certificates

This guide also covers

• cloudflare error 526
• invalid ssl certificate cloudflare
• 526 cloudflare full strict

Other Cloudflare errors

• Cloudflare Error 521: Web Server Is Down
• Cloudflare Error 522: Connection Timed Out
• Cloudflare Error 524: A Timeout Occurred
• Cloudflare Error 525: SSL Handshake Failed
• Cloudflare Error 520: Web Server Returned an Unknown Error
• Cloudflare Error 1020: Access Denied
• Cloudflare Error 1015: You Are Being Rate Limited
• Cloudflare Error 1016: Origin DNS Error