525 SSL Handshake Failed

Cloudflare: the TLS handshake between Cloudflare and the origin failed.

525 at a glance

Code: 525
Name: SSL Handshake Failed
Class: 5xx Server error
Status: Non-standard used by Cloudflare
Documented by: Cloudflare
Cacheable by default: No by default. Caches only store responses with unrecognised status codes if explicit freshness (Cache-Control max-age) is given.

What 525 means

Cloudflare returns 525 when SSL/TLS mode is Full or Full (strict) and the TLS handshake with the origin fails, so no request could be sent. The certificate itself may be fine; the handshake never completed.

What typically causes a 525

No certificate or no TLS listener on port 443 at the origin.
The origin does not support SNI, or serves no certificate for the requested hostname.
No cipher suites or TLS versions in common between Cloudflare and the origin.
Origin firewall or IDS interrupting the handshake.

Fix it on the server

Test the origin directly: openssl s_client -connect <origin-ip>:443 -servername example.com.
Install a certificate (a Cloudflare Origin CA certificate works for Full strict) and enable modern TLS versions.

Fix it as a client or visitor

Nothing to do on the client side; report it to the site owner.

Headers that go with 525

Header	Role
`CF-RAY`	Request ID for troubleshooting.

Example response

HTTP/1.1 525
Server: cloudflare
Content-Type: text/html