SteadyNode

Cloudflare · HTTP 526

Cloudflare Error 526: Invalid SSL Certificate

Resolve Cloudflare 526 in Full (strict) mode by checking origin certificate validity, hostname matching, trust, and the complete served chain.

Origin / TLS Configuration

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

CF-526

Fault domain

Origin / TLS Configuration

Why it happened

Cloudflare completed TLS negotiation but rejected the origin certificate under strict validation. Expiry, hostname mismatch, an untrusted issuer, or an incomplete chain can make the certificate invalid.

Actionable fixes

  1. Verify certificate dates, subject alternative names, issuer trust, and intermediates for the origin hostname.
  2. Serve the full chain from the origin and reload the web server after installing the renewed certificate.
  3. Keep strict validation enabled; do not treat disabling certificate checks as a production fix.

Why this error happened

Cloudflare completed TLS negotiation but rejected the origin certificate under strict validation. Expiry, hostname mismatch, an untrusted issuer, or an incomplete chain can make the certificate invalid.

Actionable fixes

  1. Verify certificate dates, subject alternative names, issuer trust, and intermediates for the origin hostname.
  2. Serve the full chain from the origin and reload the web server after installing the renewed certificate.
  3. Keep strict validation enabled; do not treat disabling certificate checks as a production fix.

Network failure point

Client -> Cloudflare Edge -> TLS handshake -> certificate validation fails -> X Origin

Verify origin directly via CLI

openssl s_client -connect ORIGIN_IP:443 -servername example.com -verify_return_error -showcerts </dev/null

Configuration fix

nginx.confnginx
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

Catch this failure before it becomes an outage

SteadyNode's TLS Chain Debugger tracks certificate expiry and chain validation, giving teams warning before an invalid origin certificate interrupts proxied traffic.

No credit card required.

Start for free

Frequently asked questions

When does Cloudflare return 526?

Cloudflare returns 526 when strict origin certificate validation fails, commonly because the certificate is expired, mismatched, untrusted, or incomplete.

Is turning off Full (strict) mode a safe fix?

It removes a security check rather than repairing the origin certificate. Restore a valid chain and keep strict validation enabled.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy