How to Fix Cloudflare Error 526 (Invalid SSL Certificate)
What Error 526 means
Error 526 is Cloudflare's way of saying "I don't trust this site's certificate." When a visitor opens your site, Cloudflare sits between them and your origin server. In strict SSL modes, Cloudflare validates the certificate installed on your origin the same way a browser would — and if that certificate is expired, self-signed, issued for a different hostname, or has a broken chain, Cloudflare kills the connection and shows the 526 page instead of serving an untrusted page.
That is what makes a 526 different from the neighboring Cloudflare errors: a 525 means the SSL handshake itself failed, while a 526 means the handshake happened but the certificate presented could not be trusted. Either way, nothing you do as a visitor will fix it — the certificate lives on the site's server, and only the site owner can repair or replace it.
Common causes
- Expired origin certificate: the certificate on the server lapsed — the most common cause, often because an auto-renew job silently broke.
- Self-signed certificate: the origin presents a certificate it issued to itself, which no one trusts — common on fresh servers and staging setups.
- Hostname mismatch: the certificate covers example.com but visitors reach the site through www.example.com (or a subdomain) that is not in the certificate's SAN list.
- Broken certificate chain: the server sends the certificate but omits the intermediate certificates browsers need to trace it back to a trusted root.
- SSL mode changed to Full (strict): the origin always had a bad certificate, but Flexible mode was hiding it; switching on validation exposed the 526.
How to fix Error 526 — step by step
Step 1 is for visitors. Steps 2 through 6 are for site owners.
- Visitor: rule out your device with a quick check. Try the site in a different browser or a private window, and load it over mobile data instead of Wi-Fi. If Error 526 appears everywhere, the problem is the site's certificate, not your device — stop troubleshooting and move on to the alternatives below. Clearing your cache or reinstalling a browser will not fix a 526, because the certificate lives on the site's server, not in your browser.
- Site owner: check whether the origin certificate is valid. Visit an independent SSL checker such as ssllabs.com/ssltest or digicert.com/help and test your domain's ORIGIN server (bypassing Cloudflare — use your server's IP or a direct subdomain like direct.example.com). The report will tell you the exact failure: expired certificate, self-signed certificate, hostname mismatch, or a broken chain. Write down what it says — your fix depends on it.
- Site owner: renew or install a valid certificate on the origin. In your hosting control panel, open the SSL/TLS or Security section. If the certificate is expired, renew it — many hosts offer free Let's Encrypt certificates that auto-renew. If the certificate is self-signed or issued for the wrong domain, install a new one whose Subject Alternative Names (SANs) cover every domain Cloudflare protects (the root and www at minimum). After installing, re-run the SSL checker from the previous step until the origin passes cleanly on its own.
- Site owner: match the Cloudflare SSL/TLS mode to the origin. Log in to Cloudflare, open your domain, then go to SSL/TLS, then Overview. If the origin now has a valid certificate, set the mode to Full (strict) — this is the only mode where Cloudflare validates the origin certificate. Do NOT leave the site on Flexible if it was there to mask the problem, and do not switch to Full (strict) while the origin certificate is still broken, or the 526 will persist. If you changed modes, wait a minute for the setting to propagate.
- Site owner: check for certificates covering the wrong hostname. A 526 also fires when the origin certificate is valid but issued for a different name — for example, it covers example.com but visitors hit www.example.com, or it is a multi-domain cert that dropped one of your subdomains. In the SSL checker report from step 2, compare the certificate's SAN list against the hostname that shows the 526. Either reissue the certificate to include the missing hostname, or redirect the affected hostname to one the certificate covers.
- Site owner: purge the Cloudflare cache and retest. Back in Cloudflare, go to Caching, then Configuration, and click Purge Everything to clear any cached error responses. Then load the site in a fresh private window. If the 526 is gone, monitor for 24 hours — certificate propagation and edge caching can make the error linger in some regions briefly. If it returns, re-run the SSL checker: a certificate that fails again within hours usually means an auto-renew job is broken or a proxy/CDN layer in front of your origin is serving the wrong cert.
Did this fix it? Quick checklist
- The site loads in a private window with no 526 page
- The SSL checker passes the origin certificate cleanly
- The certificate covers every hostname behind Cloudflare
- Cloudflare SSL mode is set to Full (strict)
If you are a visitor and the 526 persists for a day or more, the owner's certificate renewal is stuck — try the site's app, its social pages, or a web-cache copy in the meantime, and report the error to the owner through whatever contact channel you have. If you are an owner and the certificate keeps expiring, automate renewal properly: enable auto-renew on your Let's Encrypt or host-issued certificate, add a calendar reminder a week before each expiry, and confirm the renewal job actually reloads the web server — a renewed certificate that never gets loaded still serves the old, expired one.
Frequently asked questions
What does Cloudflare Error 526 mean?
Error 526 means Cloudflare cannot establish a secure connection to your origin server because the origin's SSL certificate is invalid — it is expired, self-signed, issued for the wrong hostname, or the chain is broken. Cloudflare blocks the page rather than serving it over an untrusted connection.
Can I fix Error 526 as a visitor?
No — the certificate belongs to the site, so only the site owner can fix it. As a visitor you can confirm the problem is real by testing another browser or network, then use an alternative route (the site's app, its social pages, or a cached copy) and contact the owner if you need the site urgently.
Why does Error 526 appear right after I changed my Cloudflare SSL mode?
Because switching to Full (strict) turns on origin-certificate validation. If the origin was previously running with an expired or self-signed certificate behind Flexible mode, the stricter mode immediately exposes it as a 526. The fix is to install a valid certificate on the origin, not to switch back to Flexible.
How long does it take for Error 526 to clear after fixing the certificate?
Usually within a minute or two of installing a valid certificate and purging the Cloudflare cache. If it lingers in some regions, cached error responses are to blame — purge everything and wait up to a few hours. A 526 that keeps returning means the certificate itself is still failing on the origin.