Skip to content

526 Invalid SSL Certificate

The origin presented a TLS certificate that could not be validated.

Status

HTTP/1.1 526 Invalid SSL Certificate

Details

  • Category: 5xx
  • Status: Unofficial (Cloudflare). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

526 appears with Full (strict) SSL mode, where the origin certificate must be valid and trusted. A self-signed, expired, or hostname-mismatched certificate produces 526 even though the handshake itself could technically proceed.

The difference from 525 is that the handshake failed outright there, while here it is validation that failed.

Common causes

  • A self-signed certificate on the origin under Full (strict) mode.
  • An expired origin certificate.
  • A certificate whose common name or SAN entries do not cover the hostname.
  • A missing intermediate certificate, so the chain cannot be built.

How to fix it

As the client

  • Nothing on the client side. The certificate problem is at the origin.

As the server

  • Install a publicly trusted certificate, or a CDN-issued origin certificate, and include the full chain.
  • Automate renewal. Expired origin certificates are the most common cause.
  • Check hostname coverage with openssl x509 -noout -text and confirm the SAN list.

Examples

An origin certificate that does not validate

HTTP request

GET / HTTP/1.1
Host: www.example.com

HTTP response

HTTP/1.1 526
Server: cloudflare

See also