What it means
In Full or Full (strict) SSL mode, Cloudflare talks to the origin over HTTPS. If the TLS handshake fails because the origin has no certificate, shares no cipher suites, or isn't listening on 443, a 525 is shown.
Most common causes
- No SSL certificate installed on the origin server.
- The server isn't listening on port 443.
- No shared cipher suites or TLS versions.
- Missing SNI or a misconfigured virtual host.
What you can do as a visitor
- You can't fix this error. Try again later.
What the site owner or developer should do
- Install a valid certificate on the origin (e.g. Cloudflare Origin CA or Let's Encrypt).
- Check that the server listens on 443 and supports TLS 1.2 or 1.3.
- You can temporarily set the SSL mode to Flexible, but that's not a secure long-term fix.
Impact on SEO and Google
The site is unreachable while the error lasts; if it persists, your indexing is at risk.
Frequently asked questions
525 or 526?
525: the TLS handshake fails. 526: the handshake succeeds, but the origin certificate is invalid (Full strict).
Is Flexible SSL a fix?
Only a temporary one. Traffic between Cloudflare and the origin is then unencrypted.