How to Fix Cloudflare Error 525 (SSL Handshake Failed)
Cloudflare Error 525 means the SSL handshake between Cloudflare and your origin server failed, so the secure connection could not be set up. It affects visitors when your Cloudflare SSL mode is Full or Full (strict), and it almost always traces back to the certificate or configuration on your server. It is fixable, usually by installing a valid certificate. Our guide to free Let’s Encrypt SSL walks through that part.
What the error means
When Cloudflare SSL mode is set to Full or Full (strict), Cloudflare opens a secure, encrypted connection to your origin server. That setup step is the SSL/TLS handshake. Error 525 appears when the handshake fails: Cloudflare and your server cannot agree on how to secure the connection, or the server has no working certificate to present. The result is that the encrypted link never forms, so Cloudflare shows the 525 page instead of your site.
Common causes
- No valid SSL certificate on the origin for that domain.
- Port 443 is closed at the origin.
- A cipher suite mismatch between Cloudflare and the origin.
- The origin is not configured for the hostname, so SNI fails.
- Certificate or server configuration errors.
How to fix it
The real fix is a valid certificate on the origin. A temporary SSL mode change can get the site back online while you sort it out, but treat that as a stopgap, not the solution.
- Install or renew a valid SSL certificate on the origin for the exact domain.
- Make sure port 443 is open and listening.
- Confirm the certificate covers the exact hostname, including www if you use it.
- Check that the origin supports modern TLS so the ciphers match.
- As a temporary workaround, set Cloudflare SSL mode to Full instead of Full (strict) while you fix the certificate. Fixing the certificate is still the real answer.
On JetHost hosting
On JetHost, AutoSSL issues a free Let’s Encrypt certificate for your domain automatically. For a 525, check that the certificate is installed and that it covers both the domain and the www version. You can confirm this in the SSL/TLS Status page in cPanel. If AutoSSL will not issue a certificate, often because a DNS record or redirect is in the way, open a ticket and our support team will get it issued for you.
JetHost Experts Tip
Switching Cloudflare to Full gets you online fast, but it is only a stopgap. Install a valid certificate so the connection is properly secured end to end.
Frequently asked questions
The SSL handshake between Cloudflare and your origin failed, usually because the origin has no valid certificate, port 443 is closed, or the TLS settings do not match.
It is only a temporary workaround. Full mode skips the strict certificate check, so the site loads, but the right fix is to install a valid certificate on the origin.
Yes. AutoSSL issues a free Let’s Encrypt certificate automatically. Check in cPanel that it is active and covers your domain and the www version.
New Hosting Plan with 80% OFF
Upgrade your website’s home without the heavy bill. Get new hosting plan with a huge 80% discount. Get free SSL, email accounts, and a control panel to manage your site. Enjoy fast performance, secure environment, and 24/7 support – all in one affordable package.
Need more help?
If the handshake still fails, open a ticket through Client Area, then Support Tickets, and we will check the certificate on the server.
