526 Invalid SSL Certificate

Cloudflare: in Full (strict) mode, the origin's certificate could not be validated.

526 at a glance

Code: 526
Name: Invalid SSL Certificate
Class: 5xx Server error
Status: Non-standard used by Cloudflare
Documented by: Cloudflare
Cacheable by default: No by default. Caches only store responses with unrecognised status codes if explicit freshness (Cache-Control max-age) is given.

What 526 means

Cloudflare returns 526 when SSL/TLS mode is Full (strict) and the origin presents a certificate that is expired, self-signed, issued by an untrusted CA, or does not cover the hostname.

What typically causes a 526

Expired Let's Encrypt certificate on the origin (renewal failing because port 80 is blocked or challenges are not reachable).
Self-signed certificates with Full (strict) mode.
Certificate hostname mismatch (cert for www only, request for the apex).
Missing intermediate certificates in the origin's chain.

Fix it on the server

Renew or replace the certificate, or install a free Cloudflare Origin CA certificate valid for up to 15 years.
Check the chain with openssl s_client -showcerts.

Fix it as a client or visitor

Nothing to do on the client side.

Headers that go with 526

Header	Role
`CF-RAY`	Request ID for troubleshooting.

Example response

HTTP/1.1 526
Server: cloudflare
Content-Type: text/html