A 525 error indicates that the SSL/TLS handshake between Cloudflare’s edge network and the origin web server failed.
This error occurs when a website uses Cloudflare’s Full or Full (Strict) SSL encryption mode. Cloudflare contacts the origin server over port 443, but the two servers cannot negotiate an encryption cipher suite or establish a secure TLS session.
Common cause
- The origin server does not have a valid SSL certificate installed on port 443.
- The origin web server does not support Server Name Indication (SNI).
- Cipher suite mismatch between Cloudflare and the origin server.
- The origin server is listening on port 443 with plain HTTP instead of HTTPS.
Steps you could possibly take:
If you are a visitor:
- The error lies between Cloudflare and the hosting company. You cannot resolve it on your local device.
If you are the website owner:
- Verify origin SSL certificate - Use an SSL checker (or
curl -ivk https://<origin-ip>) to verify that your origin server has an active SSL certificate installed on port 443. - Review SSL/TLS encryption mode - In the Cloudflare dashboard under SSL/TLS > Overview, verify your encryption setting. If your origin lacks an SSL certificate, install a free Cloudflare Origin CA Certificate.
- Check cipher suites - Ensure your origin server supports modern TLS versions (TLS 1.2 or TLS 1.3) and modern cipher suites.
Source: Cloudflare Documentation - Troubleshooting Cloudflare 5XX errors (Error 525)