What it means
Cloudflare-specific: in Full (strict) SSL mode, the origin's certificate is invalid, expired, self-signed or does not match the host name.
Common causes
- Expired certificate on the origin
- Self-signed certificate
- Certificate issued for another hostname
How to fix it
As a client or visitor
Retry later; only the site owner can fix it.
As the site or API owner
Renew the origin certificate or install a Cloudflare Origin CA certificate that covers the host name.
Example response
HTTP/1.1
HTTP/1.1 526 Invalid SSL Certificate
Date: Tue, 07 Oct 2025 09:30:00 GMT
Server: nginx
Content-Length: 0Specification
Not in the IANA registry; used by Cloudflare. Cloudflare
FAQ
› Why did 526 start suddenly?
Most often the origin's certificate (for example, Let's Encrypt) expired and auto-renewal failed.
› Is a Cloudflare Origin CA certificate trusted by browsers?
No, only by Cloudflare. That is enough because visitors only connect to Cloudflare.