Diagnose HTTPS errors with Cloudflare enabled

Reviewed on September 8, 2026 2 min read cloudflare ssl

With Cloudflare there are two separate TLS connections: from the visitor to Cloudflare, and from Cloudflare to the origin server. Each one can present a different certificate. First capture the exact error, then check which leg is failing.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

In Cloudflare > SSL/TLS > Edge Certificates, check that Universal SSL is active and covers the hostname. Also check that the correct DNS record is proxied. The error alone does not prove that Cloudflare failed to issue the certificate.

Error 525

Cloudflare could not complete the TLS handshake with the origin. Check that the server responds on port 443 for that hostname, presents the certificate via SNI and supports a compatible TLS configuration. Match the time against the origin's TLS logs.

Error 526

With Full (strict), Cloudflare could not validate the certificate presented by the origin. Check the expiry, that the hostname is included in the SAN, the full chain and trust. Run AutoSSL from SSL/TLS Status if the hosting's public certificate is not valid.

Keep Full (strict) when the origin has a valid certificate. Do not switch to Flexible or remove and re-add the domain as a test: those actions can hide the fault or change DNS, cache and rules without identifying the cause.

Certificate coverage and direct tests

In a zone with a full DNS setup, Universal SSL normally covers the apex and the first level of subdomains. Do not assume it also covers tienda.eu.dominio.com: check the names on the certificate and the Universal SSL limitations. Other setup types may have different coverage.

A Cloudflare Origin CA certificate is designed for the Cloudflare-to-origin connection and is not generally trusted by browsers. If a warning appears when you test the origin directly, tell that case apart from an expired public certificate before replacing it.

Keep the hostname, the time and the Ray ID if one appears. Cloudflare's official guides for 525 and 526 help you work out which leg is affected; do not disable TLS validation to call the issue resolved.