526 Invalid SSL Certificate
A Cloudflare-specific code: in Full (strict) mode, the origin certificate is expired, self-signed, or otherwise untrusted.
Cloudflare could not validate the origin server's SSL certificate.
526 is an unofficial status code used by Cloudflare. It is not part of the HTTP standard or the IANA registry.
What HTTP 526 Invalid SSL Certificate Means
Cloudflare could not validate the origin server's SSL certificate.
A Cloudflare-specific code: in Full (strict) mode, the origin certificate is expired, self-signed, or otherwise untrusted.
Common Causes
- Expired origin certificate
- Self-signed or untrusted certificate in strict mode
- Hostname mismatch on the certificate
- Incomplete certificate chain
How to Fix It (For Visitors)
- Contact the website owner
How to Fix It (For Developers/Admins)
- Install a valid, trusted certificate (or a Cloudflare Origin CA cert)
- Include the full chain and correct hostnames
- Switch to Full (not strict) only as a temporary measure
- Renew expired certificates
How to Troubleshoot Cloudflare Errors
Every Cloudflare error page shows a Ray ID and tells you whether the browser, Cloudflare, or the origin host is failing. To test the origin directly while keeping the correct hostname, bypass Cloudflare with curl:
# Replace 203.0.113.10 with your origin server's IP
curl -svo /dev/null --resolve example.com:443:203.0.113.10 https://example.com/If this request fails or is slow, the problem is on the origin, not at Cloudflare. Also make sure your firewall, security plugins, and rate limiters allow Cloudflare's IP ranges.
In Full (strict) mode the origin certificate must be unexpired, cover the requested hostname, and be issued by a publicly trusted CA or by Cloudflare's Origin CA.
Frequently Asked Questions
What does HTTP 526 Invalid SSL Certificate mean?
A Cloudflare-specific code: in Full (strict) mode, the origin certificate is expired, self-signed, or otherwise untrusted. In short: Cloudflare could not validate the origin server's SSL certificate.
Is 526 an official HTTP status code?
No. 526 is not registered in the IANA HTTP Status Code Registry; it is specific to Cloudflare. A client that receives an unrecognized status code treats it like the generic 500 code of its class.
How do I fix a 526 Invalid SSL Certificate error?
Install a valid, trusted certificate (or a Cloudflare Origin CA cert). Include the full chain and correct hostnames. Switch to Full (not strict) only as a temporary measure.
Specification Status
526 Invalid SSL Certificate is not an official HTTP status code. It is not registered in the IANA HTTP Status Code Registry and is specific to Cloudflare. Other servers and clients may not recognize it.