Cloudflare Error 526 Invalid SSL Certificate: Fix

Cloudflare Error 526 ("Invalid SSL certificate") happens when your SSL mode is Full (strict) and the certificate on your origin server fails validation. The handshake works, but Cloudflare refuses to trust the certificate. The fix is always to put a valid certificate on the origin, not to weaken the SSL mode.

Before you start

cPanel access (open it from Services in the MdmHost dashboard).
The exact hostname that fails, for example www.example.com or a subdomain.

Why Cloudflare rejects the certificate

Expired – AutoSSL or a paid certificate was not renewed.
Self-signed – the server's default certificate, not issued by a trusted authority.
Wrong name – the certificate covers example.com but not www or the subdomain requested.
Incomplete chain – the intermediate certificate is missing.

How to fix error 526

Inspect the origin certificate. Run openssl s_client -connect ORIGIN_IP:443 -servername www.example.com | openssl x509 -noout -subject -dates -ext subjectAltName and check the dates and names.
Renew or issue with AutoSSL. Go to cPanel → Security → SSL/TLS Status, select the domains (including www) and click Run AutoSSL. If it fails behind Cloudflare, read AutoSSL not working.
Or install a Cloudflare Origin Certificate. Create it in Cloudflare → SSL/TLS → Origin Server covering example.com and *.example.com, then paste the certificate and key in cPanel → SSL/TLS → Manage SSL sites. Cloudflare trusts it in strict mode.
Fix the chain for paid certificates by adding the CA bundle. See incomplete certificate chains.
Reload through Cloudflare once the origin shows a valid certificate.

Tip: Set a reminder or check SSL/TLS Status monthly if you use a paid certificate. AutoSSL renews automatically; manually installed certificates do not.

What to check afterwards

Load every hostname you use (root, www, subdomains) through Cloudflare. All should show the padlock without errors.

FAQ

Can I just switch to Full instead of Full (strict)?

It removes the error but stops Cloudflare checking the certificate, so the connection is open to interception. Keep strict and fix the certificate.

Are Cloudflare origin certificates free?

Yes, and they can last up to 15 years, but browsers only trust them through Cloudflare's proxy.

Why does only www show error 526?

The certificate does not include www. Reissue it with both names.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AI Open a ticket