Error 525: SSL handshake failed
Cloudflare could not complete TLS with your origin
Seen in Cloudflare
In Full or Full (strict) mode, the TLS handshake between Cloudflare and your origin failed.
Common causes
- The origin has no certificate or TLS isn't enabled on 443.
- No cipher or TLS version in common.
- SNI not configured for this name on the origin.
How to fix it
- Install a certificate on the origin (a Cloudflare Origin CA certificate works).
- Enable TLS 1.2+ on the origin.
- Make sure the origin serves this hostname over TLS.
Got a different message? Paste it into the error explainer.
Related errors
- Error 526: Invalid SSL certificate · Cloudflare doesn't trust your origin's certificate
- 421 Misdirected Request · The request reached a server that cannot answer for this hostname
- 502 ERROR The request could not be satisfied. CloudFront wasn't able to connect to the origin. · CloudFront could not get a valid response from the origin
- 502 Bad Gateway · The proxy got a bad response from the server behind it
- 503 Service Unavailable · The server is temporarily unable to handle requests
- 504 Gateway Timeout · The server behind the proxy took too long
- Error 520: Web server is returning an unknown error · Cloudflare got an empty or invalid response
- Error 521: Web server is down · Cloudflare could not connect to your origin
- Error 522: Connection timed out · Cloudflare timed out connecting to your origin
- 429 Too Many Requests · You've hit a rate limit
- 400 Bad Request · The server could not understand the request
- 401 Unauthorized · The request needs valid credentials