526: Invalid SSL Certificate, what it means and what to do
This code is not part of the official HTTP standard. It comes from Cloudflare, the network that sits in front of a large share of the web, and you only see it on sites that use Cloudflare. Error 526 means Cloudflare reached the origin over HTTPS, received its certificate, and refused to trust it. This happens when Cloudflare's SSL mode is Full (Strict), the setting that requires the origin's certificate to be valid, unexpired, issued by a trusted authority (or Cloudflare's own origin CA), and covering the requested hostname. A 526 is therefore a precise accusation: the origin's certificate fails one of those checks, and Cloudflare names the failed validation rather than connecting anyway.
If you are just visiting a site
- Wait and retry in a few minutes. The problem sits between Cloudflare and the site's own server, and it often clears when that server recovers.
- There is nothing to fix on your device. A different browser, a cleared cache, or a restarted phone produces the same error, because your request reached Cloudflare successfully and failed after that.
- Tell the site owner through another channel if it persists, their social account or a status page. Owners often learn about origin failures from visitors first.
If it is your site behind Cloudflare
- Check the certificate's expiry date first. Expired origin certificates are the leading cause. Renewal automation that silently failed shows up here before it shows up anywhere else, because browsers never see the origin certificate directly.
- Confirm the certificate covers the hostname. A certificate issued for a different domain or subdomain, or a default self-signed certificate left over from the server's first setup, both fail validation.
- Replace self-signed certificates. Full (Strict) does not accept them. Cloudflare's free Origin CA certificates are made for exactly this spot, or use any public CA such as Let's Encrypt.
- Understand the tempting non-fix. Dropping the SSL mode from Full (Strict) to Full makes the 526 vanish by no longer validating the certificate. That restores the site by weakening its security, and it should be a conscious, temporary decision, not a reflex.
Visitors: the site's own certificate failed inspection, and only the owner can renew or replace it. Owners: fix the certificate, not the strictness, the strictness is what told you the truth.
Common questions
Why does the site work for some checks but show 526 in a browser? Because visitors connect to Cloudflare, not to your origin. Cloudflare presents its own valid certificate to browsers, so browser-side checks look healthy. The failing certificate is on the origin, visible only on the Cloudflare-to-origin leg, which is exactly what a 526 reports.
Can a 526 appear suddenly on a site that worked for months? Yes, and expiry is the usual reason. Certificates have fixed lifetimes, and the day one lapses, a Full (Strict) configuration starts returning 526 for every request until the origin certificate is renewed.
Related errors