Cloudflare Error 525 ("SSL handshake failed") means Cloudflare connected to your origin on port 443 but could not complete the TLS handshake. It happens when the SSL mode is Full or Full (strict) and the origin has no usable certificate for the domain, or cannot agree on TLS settings with Cloudflare.
Before you start
- Check your mode in Cloudflare → SSL/TLS → Overview.
- cPanel access to view the certificate under Security → SSL/TLS Status.
Common causes of Cloudflare Error 525
- No certificate installed for the domain on the origin server.
- AutoSSL failed because Cloudflare's proxy blocked domain validation.
- The origin does not support SNI or serves a default certificate for another site.
- No shared TLS version or cipher, for example an old server only offering outdated protocols.
- Port 443 handled by a different service than the web server.
How to fix error 525
- Test the origin handshake. Run
openssl s_client -connect ORIGIN_IP:443 -servername example.com. A failure or a certificate for another name confirms the problem. - Install a certificate. In cPanel → Security → SSL/TLS Status click Run AutoSSL. On MdmHost hosting AutoSSL is free. If validation fails, see common SSL errors.
- Or use a Cloudflare Origin Certificate. Create one in SSL/TLS → Origin Server and install it in cPanel → SSL/TLS → Manage SSL sites. It is trusted only by Cloudflare, which is fine behind the proxy.
- On a VPS, make sure the web server listens on 443 with a virtual host for the domain and supports TLS 1.2 or 1.3.
- Retest through Cloudflare. Once the origin handshake works, switch to Full (strict) for proper security.
Warning: Switching to Flexible SSL makes 525 go away but leaves the Cloudflare-to-server link unencrypted and often causes redirect loops. Fix the origin certificate instead.
What to check afterwards
Open the site in a private window and check the padlock. Run the openssl s_client command again; it should show your domain's certificate and Verify return code: 0 for a public certificate.
FAQ
What is the difference between 525 and 526?
525: the handshake itself failed. 526: the handshake worked but the certificate is invalid in Full (strict) mode.
Why did AutoSSL stop working after adding Cloudflare?
Validation requests can be challenged or cached by Cloudflare. A DNS-validated certificate or an origin certificate avoids this.
Is an origin certificate enough?
Yes, as long as the record stays proxied through Cloudflare.