525: SSL Handshake Failed, what it means and what to do

This code is not part of the official HTTP standard. It comes from Cloudflare, the network that sits in front of a large share of the web, and you only see it on sites that use Cloudflare. Error 525 means the secure introduction failed. When Cloudflare connects to an origin over HTTPS, the two sides perform a TLS handshake to agree on encryption before any page is exchanged. A 525 says that handshake with the origin failed, so the connection was abandoned. Your browser's connection to Cloudflare is fine; the broken link is the second one, between Cloudflare and the site's own server, and its certificate and TLS configuration are where the answers live.

If you are just visiting a site

  1. Wait and retry in a few minutes. The problem sits between Cloudflare and the site's own server, and it often clears when that server recovers.
  2. There is nothing to fix on your device. A different browser, a cleared cache, or a restarted phone produces the same error, because your request reached Cloudflare successfully and failed after that.
  3. Tell the site owner through another channel if it persists, their social account or a status page. Owners often learn about origin failures from visitors first.

If it is your site behind Cloudflare

  1. Check that the origin actually serves HTTPS on port 443. If the origin has no working TLS listener, often after a server rebuild or a certificate tool failure, the handshake has nothing to talk to. This is the most common 525 story.
  2. Verify the origin certificate is installed and complete. A missing intermediate chain, a certificate installed for the wrong hostname, or a broken key pairing all fail the handshake. An SSL checker against the origin address shows the chain state.
  3. Compare cipher and protocol support. If the origin only offers ciphers or TLS versions Cloudflare does not accept (or the reverse after a hardening change), the two sides find no common language and the handshake dies.
  4. Review your Cloudflare SSL mode. Modes that require origin HTTPS (Full and Full Strict) will surface origin TLS problems as 525, where Flexible mode would mask them by using plain HTTP to the origin.
Visitors: the failure is between the site's front door and its server, entirely the owner's territory. Owners: test the origin's 443 directly, a 525 rarely survives a careful look at the certificate installation.

Common questions

What is the difference between 525 and 526? A 525 means the TLS handshake itself failed: the two sides could not establish a secure connection at all. A 526 means the handshake succeeded but the certificate the origin presented was invalid, for example expired, self-signed, or for the wrong name, while Cloudflare was in Full (Strict) mode.

Why did a 525 start after renewing a certificate? Renewals change files, and an incomplete installation, missing intermediate certificates, a service that was never reloaded to pick up the new files, or the new certificate landing on the wrong virtual host, are all classic renewal-day failures.

Related errors

526 Invalid SSL Certificate · 522 Connection Timed Out · 502 Bad Gateway