Cloudflare error 525 "SSL handshake failed" means Cloudflare could not complete the TLS handshake with your origin server. It happens only when the SSL/TLS mode is Full or Full (strict), because those modes make Cloudflare connect to the origin over HTTPS.
Cloudflare lists four causes:
- No valid SSL certificate is installed on the origin.
- Port 443, or your custom HTTPS port, is closed.
- The origin does not support SNI.
- The cipher suites Cloudflare offers do not match the cipher suites the origin supports.
Quick fix for site owners: run this test against your origin IP. Replace 203.0.113.10 and example.com with your values:
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null
If it fails, the output tells you which of the four causes you have. The next section explains how to read it.
Visitors: refresh once and wait. The failure is between Cloudflare and the website's server, so only the site owner can fix it.
How to read the openssl s_client test
The command connects to the origin directly, sends the hostname with SNI, and prints the handshake result.
| Output | Likely cause | Fix |
|---|---|---|
Connection refused or connect:errno=111 |
Nothing listens on port 443 | Enable HTTPS on the web server and open port 443 |
| Connection hangs, then times out | Firewall drops port 443 | Allow Cloudflare IP ranges on port 443 |
Handshake error plus no peer certificate available |
The handshake failed before the server sent a certificate | Confirm a certificate is configured for this hostname, then check TLS versions and ciphers |
handshake failure or no shared cipher alert |
No common TLS version or cipher | Enable TLS 1.2 or 1.3 and modern ECDHE cipher suites |
Works with -servername, fails without it |
Normal for SNI-based hosting | Nothing, Cloudflare sends SNI |
| Wrong certificate subject for your hostname | SNI or virtual host misconfigured | Fix the server block or virtual host for that hostname |
You can also test a specific TLS version. Add -tls1_2 or -tls1_3 to the command. If both fail, the origin has no TLS version in common with Cloudflare.
A quick second check with curl skips certificate validation, which is what Full mode does:
curl -vk --resolve example.com:443:203.0.113.10 https://example.com/
If curl completes the handshake here but Cloudflare still shows 525, compare the origin's cipher list with the list on Cloudflare's origin cipher suites page. Also check whether a firewall or security tool treats Cloudflare IPs differently.
How to fix error 525 as a website owner
1. Confirm port 443 is open. On the server:
sudo ss -tlnp | grep ':443'
No output means no process listens for HTTPS. Enable the HTTPS server block or virtual host, then reload the web server.
2. Install a valid certificate. Cloudflare's docs recommend a free Cloudflare Origin CA certificate if the origin has none. Browsers do not trust Origin CA certificates, but Cloudflare does, which is all you need behind the proxy.
3. Check SNI and virtual hosts. Each hostname needs a server block or virtual host that serves its certificate. If one subdomain fails and others work, that hostname probably falls through to a default block without a certificate.
4. Check cipher suites and TLS versions. Old configs that allow only legacy ciphers, or only TLS 1.0, can fail the handshake. Use a current Mozilla "intermediate" style config, which allows TLS 1.2 and 1.3 with ECDHE ciphers.
5. Read the TLS errors in your logs. Cloudflare suggests you look at the origin error logs at the times the 525 occurred. Raise the log level if the errors do not show:
- Apache:
LogLevel warn ssl:info - Nginx:
error_log /var/log/nginx/error.log info;
Nginx then logs lines such as SSL_do_handshake() failed with the OpenSSL reason, for example no shared cipher.
6. Check every upstream. Intermittent 525 errors often mean one server in a pool has a different certificate or TLS config. Run the openssl s_client test against each backend IP.
7. Check Origin Analytics. In the Cloudflare dashboard, the origin status codes chart shows requests where Cloudflare got no HTTP response, with an origin response status of 0. Those times usually match TLS failures in your logs.
Error 525 vs. 526
These two errors are often confused.
| Error | What failed | First check |
|---|---|---|
| 525 | The TLS handshake itself | Port 443, certificate present, SNI, ciphers |
| 526 | Certificate validation in Full (strict) mode | Expiry, trusted issuer, hostname match, chain |
With 525, the connection fails before Cloudflare can use the certificate. With 526, the handshake works, but Cloudflare rejects the certificate in Full (strict) mode.
If Cloudflare connects and gets an empty or invalid HTTP response after the handshake, the error is 520 instead.
Is "handshake failed; returned -1" the same as error 525?
No. A log line such as ssl_client_socket_impl.cc handshake failed; returned -1, SSL error code 1, net_error -101 comes from Chromium. Chrome, Electron apps, Selenium with ChromeDriver, and Qt WebEngine can print it. It describes the client's own TLS connection, not the connection between Cloudflare and an origin.
The net_error number tells you more. For example, -100 is a closed connection, -101 is a reset connection, and -202 is a certificate from an untrusted authority. A TLS-inspecting proxy, an antivirus tool, or a server without a valid certificate often causes it. It is not a Cloudflare error code.
How to fix error 525 as a visitor
- Refresh once.
- Wait a few minutes.
- Send the site owner the URL and the time.
Browser settings do not fix a 525. Your browser's connection to Cloudflare works. The failure is behind Cloudflare.
Can proxies fix error 525?
No. The failed handshake is between Cloudflare and the origin. A different visitor IP does not change the origin's certificate, port, or ciphers.
If you scrape or monitor a site and see 525, treat it as an outage on the target. Retrying fast does not repair a TLS config, so back off.
How to prevent error 525
- Monitor port 443 and run a TLS handshake check, not only a TCP check.
- Automate certificate renewal and test every backend after renewal.
- Keep TLS versions and ciphers on a current baseline.
- Keep one certificate and TLS config across all servers in a pool.
- Check the SSL/TLS mode after every host migration.
FAQ
What does Cloudflare error 525 mean?
It means Cloudflare could not complete the SSL/TLS handshake with the origin server.
What causes SSL handshake failed error code 525?
Cloudflare lists four causes: no valid certificate on the origin, port 443 closed, no SNI support, and no matching cipher suites.
Can I fix error 525 by switching to Flexible mode?
It usually removes the error, because Flexible mode connects to the origin over HTTP on port 80. It also removes encryption between Cloudflare and your server, and it causes a redirect loop if the origin forces HTTPS. Install a certificate on the origin instead.
Is error 525 the same as error 526?
No. Error 525 means the handshake failed. Error 526 means the handshake worked, but Cloudflare rejected the certificate in Full (strict) mode.
Technical reference: Cloudflare error 525 documentation.