526 Invalid SSL Certificate

Cloudflare could not validate the TLS certificate presented by the origin server.

Last updated . How this page is checked.

Status code526
Status textInvalid SSL Certificate
Category5xx Server Error
Response has bodyUsually
Defined byCloudflare (not an IANA-registered code)

What does 526 Invalid SSL Certificate mean?

Cloudflare could not validate the TLS certificate presented by the origin server. It is numbered in the 5xx Server Error range but is not a registered HTTP status code, so the general meaning of that class is only a rough guide to it.

When do APIs return 526?

On sites behind Cloudflare with the SSL mode set to Full (strict), which requires the origin's certificate to be valid. It fails when that certificate has expired, is self-signed, does not cover the requested host name, or is missing its intermediate chain.

How to fix a 526 Invalid SSL Certificate

Install a valid certificate on the origin: one from a public authority, or a Cloudflare Origin CA certificate, which strict mode also accepts. Check the expiry date and that the certificate lists the host name. Lowering the SSL mode to Full makes the error disappear by no longer checking, which removes the protection strict mode was providing.

Reproduce a 526 response

The fastest way to understand a status code is to trigger one and read the full response. Open the API tester and send a request to https://httpbin.org/status/526 — you will see the 526 status along with every response header the server sent. Comparing those headers against a working request is often what reveals the cause.

That response only imitates the number, which is useful for checking how your own client, alerting or retry logic treats a 526. A real one comes from the software named in the table above, in the circumstances this page describes.

When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.

Related 5xx status codes

500 Internal Server Error

The server hit an unexpected condition and could not complete the request.

501 Not Implemented

The server does not support the functionality required to fulfil the request.

502 Bad Gateway

A server acting as a gateway or proxy received an invalid response from the upstream server.

503 Service Unavailable

The server is temporarily unable to handle the request.

504 Gateway Timeout

A gateway or proxy did not receive a timely response from the upstream server.

505 HTTP Version Not Supported

The server does not support the major HTTP version named in the request.

See also

  • 525 SSL Handshake Failed — Cloudflare could not complete a TLS handshake with the origin server.
  • SSL checker — See the certificate a server presents: its chain, names and expiry date.

References