HTTP 525 SSL Handshake Failed

What does HTTP 525 mean?

Cloudflare could not complete a TLS handshake with the origin. With SSL mode “Full” or “Full (strict)” Cloudflare connects to the origin over HTTPS. If the origin has no certificate, an unsupported cipher or SNI misconfiguration, the handshake fails.

5xx Server error: The request looked valid, but the server failed to fulfil it. The fix is on the server side.

Common causes of a 525 error

• No valid certificate installed on the origin for the hostname.
• The origin does not support SNI or modern TLS versions.
• Port 443 is closed on the origin.

How to fix 525 SSL Handshake Failed

• Install a certificate on the origin (a free Cloudflare Origin CA certificate works with “Full (strict)”).
• Enable TLS 1.2+ and SNI on the origin server.
• Check with the SSL checker that the origin serves a valid certificate.

525 and SEO

Visitors and crawlers get an error page; fix it quickly.

Example response

HTTP/1.1 525 SSL Handshake Failed

Related status codes

• 526 Invalid SSL Certificate — Cloudflare could not validate the SSL certificate on the origin.
• 520 Web Server Returned an Unknown Error — Cloudflare received an empty, unknown or unexpected response from the origin server.

Check which status code a URL returns with the HTTP header checker.