525 SSL Handshake Failed

Cloudflare only shows 525 when two things are true: the SSL/TLS mode is Full or Full (strict), and the handshake with the origin did not complete. The handshake never produced a certificate for Cloudflare to judge, which is what separates it from 526, where the handshake happened and the certificate failed validation.

Cloudflare’s list of causes: no certificate installed, port 443 (or your custom secure port) not open, no SNI support, and no overlap between Cloudflare’s cipher suites and the origin’s. Intermittent 525s usually trace back to the origin resetting connections under load; nginx logs those TLS errors in its error log, sometimes only at a higher log level.

If you are visiting the site

• The encrypted link between Cloudflare and the site’s server is broken. Your own HTTPS connection to Cloudflare is fine.

If you run the server

• The zone was switched to Full or Full (strict) but the origin has no certificate, or the TLS server block is missing.
• The origin only serves TLS on a different port, or a firewall blocks 443.
• The origin requires a server name it does not receive, or cannot pick a certificate via SNI for that hostname.
• An outdated TLS stack offering only protocols or ciphers Cloudflare does not accept.

If you are visiting the site

• Nothing on your device fixes this. Let the site owner know, or try again later.

If you run the server

• Install a certificate on the origin; a free, long-lived Cloudflare Origin CA certificate is the simplest for traffic that only comes through Cloudflare.
• Run openssl s_client against the origin IP with -servername set to your hostname and read where the handshake stops.
• Make sure the server listens for TLS on 443 and the firewall allows it from Cloudflare ranges.
• Enable TLS 1.2 or 1.3 with modern cipher suites; compare with the list Cloudflare publishes for origin connections.
• As a stopgap only, Flexible mode connects to the origin over plain HTTP on port 80, which removes the handshake but also the encryption to your server.

Cloudflare generates this code at its edge when it cannot get a usable answer from your origin; your server never sends it. The commands below talk to the origin directly, skipping Cloudflare, so you can see what Cloudflare sees.

# Handshake with the origin exactly as Cloudflare does (SNI included)
openssl s_client -connect ORIGIN_IP:443 -servername example.com </dev/null

# Which protocol and cipher were agreed, if any
openssl s_client -connect ORIGIN_IP:443 -servername example.com -brief </dev/null

# Is 443 open at all?
nc -vz ORIGIN_IP 443

525 vs 526

525 means no TLS session could be set up; 526 means the session was set up but Full (strict) rejected the origin certificate as invalid.

525 vs 521

521 is a refused TCP connection; 525 gets past TCP and fails during the TLS negotiation.

Why did 525 start right after I changed the SSL/TLS mode?

Switching from Flexible to Full or Full (strict) makes Cloudflare connect to your origin over HTTPS on port 443. If the origin has no certificate or no TLS listener, every request now fails with 525.

Does error 525 mean my visitors’ connection is insecure?

No. The visitor’s connection to Cloudflare is unaffected; the failure is on the second leg, between Cloudflare and your server.

Can I use a self-signed certificate to fix 525?

Under Full mode, yes: Cloudflare does not validate the certificate, it only needs a working handshake. Full (strict) would then fail with 526 unless you use an Origin CA certificate or the Custom Origin Trust Store.

Why is error 525 intermittent?

Usually the origin resets some TLS connections under load or has one server in a pool without the certificate. Check the origin error logs at the exact times of the 525s.