APITester| Status code | 525 |
|---|---|
| Status text | SSL Handshake Failed |
| Category | 5xx Server Error |
| Response has body | Usually |
| Defined by | Cloudflare (not an IANA-registered code) |
What does 525 SSL Handshake Failed mean?
Cloudflare could not complete a TLS handshake with the origin server. It is numbered in the 5xx Server Error range but is not a registered HTTP status code, so the general meaning of that class is only a rough guide to it.
When do APIs return 525?
On sites behind Cloudflare with the SSL mode set to Full or Full (strict), where Cloudflare connects to the origin over HTTPS. The handshake fails when the origin has no certificate installed, is not listening on port 443, or shares no TLS version or cipher suite with Cloudflare.
How to fix a 525 SSL Handshake Failed
Check that the origin serves HTTPS on port 443 with a certificate installed, and that it supports current TLS versions and the SNI extension. Testing the origin directly with curl -v against its IP address shows where the handshake stops.
Reproduce a 525 response
The fastest way to understand a status code is to trigger one and read the full response. Open the
API tester and send a request to https://httpbin.org/status/525 — you will
see the 525 status along with every response header the server sent. Comparing those headers against
a working request is often what reveals the cause.
That response only imitates the number, which is useful for checking how your own client, alerting or retry logic treats a 525. A real one comes from the software named in the table above, in the circumstances this page describes.
When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.
Related 5xx status codes
500 Internal Server Error
The server hit an unexpected condition and could not complete the request.
501 Not Implemented
The server does not support the functionality required to fulfil the request.
502 Bad Gateway
A server acting as a gateway or proxy received an invalid response from the upstream server.
503 Service Unavailable
The server is temporarily unable to handle the request.
504 Gateway Timeout
A gateway or proxy did not receive a timely response from the upstream server.
505 HTTP Version Not Supported
The server does not support the major HTTP version named in the request.
See also
- 526 Invalid SSL Certificate — Cloudflare could not validate the TLS certificate presented by the origin server.
- 520 Web Server Returned an Unknown Error — Cloudflare reached the origin server and got back something it could not interpret as a valid HTTP response.
- SSL checker — See the certificate a server presents: its chain, names and expiry date.
References
- Cloudflare Docs: Error 525 — Cloudflare's own description of the cause and the checks to run.
- IANA: HTTP Status Code Registry — The official list of registered codes. This one is not on it.