Cloudflare Edge Errors
Invalid SSL Certificate
Reviewed for reference consistency: August 11, 2026
Cloudflare edge could not validate origin SSL certificate
What 526 Means
The 526 error on the Cloudflare Edge Errors indicates invalid ssl certificate — cloudflare edge could not validate origin ssl certificate. This typically occurs due to origin server ssl certificate expired or not yet valid.
Error 526 occurs when Cloudflare is configured in Full (Strict) SSL encryption mode and the origin web server presents an SSL/TLS certificate that fails cryptographic validation. Cloudflare refuses to complete the secure connection to protect end-user data from potential man-in-the-middle attacks.
Technical Background
Cloudflare's Full (Strict) SSL mode enforces end-to-end encryption with mandatory certificate validation. Unlike standard Full SSL (which permits self-signed origin certificates), Strict mode requires a valid certificate signed by a recognized Certificate Authority or a Cloudflare Origin CA certificate.
When the origin presents an expired, self-signed, or untrusted certificate, the edge proxy immediately halts traffic and returns Error 526 to the browser, ensuring encrypted traffic cannot be intercepted.
Common Causes
- Origin server SSL certificate expired or not yet valid
- Self-signed SSL certificate on origin when Full (Strict) SSL mode is enabled
- Certificate Common Name (CN) or Subject Alternative Name (SAN) does not match origin domain
- Certificate Authority (CA) that signed origin certificate is untrusted
Typical Scenarios
- An origin web server's Let's Encrypt certificate expires without automated renewal
- A website administrator enables Full (Strict) SSL mode while the origin uses a self-signed certificate
- An origin certificate is issued for a domain name mismatch after server migration
What to Know
Error 526 indicates an origin-side certificate validity issue. Confirming origin certificate expiration, domain name matching, and CA trust resolves the strict validation failure.
Frequently Asked Questions
Common questions about Cloudflare 526 error
The error happens when the network's strict encryption mode checks your origin server's SSL certificate and finds it expired, self-signed, or belonging to the wrong domain entirely.
Renewing the SSL certificate on the hosting server or generating an Origin Certificate for installation satisfies the requirements for strict encryption mode.
Dropping to Flexible forces communication to plain HTTP, defeating internal encryption. Dropping to standard Full mode is often a safer temporary workaround while replacing the certificate.
Related Error Codes
Web Server Returned an Unknown Error — the origin sent unexpected responses to the proxy
Web Server Is Down — Cloudflare cannot establish a TCP connection to the origin server
SSL Handshake Failed — Cloudflare could not negotiate a secure connection to the origin
Origin DNS Error — Cloudflare cannot resolve the origin server hostname in the zone configuration
Related Errors From Other Categories
Similar error codes documented across different platforms and systems
Process Killed — the process was terminated by a SIGKILL signal
Signal 11 (SIGSEGV) — kernel signal for invalid memory reference segmentation fault
Exit Code 139 — process terminated by segmentation fault (Signal 11 / SIGSEGV)
Input/output error EIO — a read or write operation could not complete