How to Fix Cloudflare Error 526 (Invalid SSL Certificate)

Cloudflare Error 526 means Cloudflare could not validate the SSL certificate on your origin server while SSL mode is set to Full (strict). It affects visitors trying to reach your site, and it points to a certificate problem on the server, not to Cloudflare. It is fixable, usually by installing a valid, trusted certificate. If you need to set one up, see our guide to free Let’s Encrypt SSL.

What the error means

With SSL mode set to Full (strict), Cloudflare does more than encrypt the connection to your origin. It also checks that the origin’s certificate is real, current, and trusted. Error 526 appears when that check fails. The certificate may be expired, self-signed, issued for a different hostname, or missing part of its chain. Because strict mode will not accept a certificate it cannot trust, Cloudflare blocks the connection and shows the 526 page.

Common causes

The certificate has expired.
The certificate is self-signed.
The certificate hostname does not match the domain.
The certificate chain is incomplete, with a missing intermediate.
The certificate comes from an untrusted or unknown authority.

How to fix it

The goal is a valid, publicly trusted certificate on the origin with its full chain. You have a couple of ways to get there, plus a quick stopgap.

Install a valid, publicly trusted certificate, such as Let’s Encrypt through AutoSSL, and include the full chain.
Make sure the certificate is current and matches the exact hostname.
Alternatively, install a Cloudflare Origin CA certificate, which strict mode trusts.
As a temporary workaround, switch Cloudflare SSL mode from Full (strict) to Full so the site loads while you fix the certificate.

On JetHost hosting

On JetHost, AutoSSL provides a valid Let’s Encrypt certificate, which is exactly what Full (strict) mode needs. For a 526, open the SSL/TLS Status page in cPanel and check that the certificate is active, not expired, and covers your domain. An expired or missing certificate is the usual cause. If it will not renew on its own, open a ticket and support will reissue it.

JetHost Experts Tip

A 526 is nearly always an expired or mismatched certificate. Check the SSL/TLS Status page in cPanel first; the fix is often just a renewal.

Frequently asked questions

What is the difference between Error 525 and 526?

A 525 means the SSL handshake itself failed. A 526 means the handshake worked but Cloudflare could not validate the origin’s certificate in Full (strict) mode.

Why does a self-signed certificate cause a 526?

Full (strict) mode only trusts certificates from a recognised authority. A self-signed certificate is not trusted, so validation fails. Use Let’s Encrypt or a Cloudflare Origin CA certificate instead.

How do I fix a 526 quickly?

As a stopgap, switch Cloudflare SSL mode from Full (strict) to Full so the site loads. Then install a valid, current certificate on the origin for the real fix.

New Hosting Plan with 80% OFF

Upgrade your website’s home without the heavy bill. Get new hosting plan with a huge 80% discount. Get free SSL, email accounts, and a control panel to manage your site. Enjoy fast performance, secure environment, and 24/7 support – all in one affordable package.

Need more help?

If the certificate still will not validate, open a ticket through Client Area, then Support Tickets, and we will reissue it for you.