A 526 error indicates that Cloudflare was unable to validate the SSL/TLS certificate installed on the website’s origin web server.
This error occurs exclusively when the website’s Cloudflare SSL/TLS encryption mode is set to Full (Strict). In this mode, Cloudflare demands that the origin server present an SSL certificate that is cryptographically signed by a trusted Certificate Authority (CA) and has not expired.
Common cause
- The origin server’s SSL certificate has expired (common with automated Let’s Encrypt renewal failures).
- The origin server is using a self-signed certificate instead of a trusted CA certificate.
- The domain name in the certificate does not match the hostname requested by Cloudflare.
Steps you could possibly take:
If you are a visitor:
- Inform the site owner that their origin SSL certificate has expired or is invalid.
If you are the website owner:
- Renew your origin SSL certificate - Log into your hosting server and renew your Let’s Encrypt certificate (e.g.
certbot renew). - Install a Cloudflare Origin CA Certificate - Generate a free, 15-year Origin Certificate in the Cloudflare dashboard (SSL/TLS > Origin Server) and install it on your web server.
- Temporary workaround - While renewing your certificate, temporarily toggle your SSL mode from Full (Strict) to Full in the Cloudflare dashboard to restore site uptime.
Source: Cloudflare Documentation - Troubleshooting Cloudflare 5XX errors (Error 526)