Turkey (Turkish)
Germany (German)
Worldwide (English)
Cloudflare 525 occurs when the SSL/TLS handshake between Cloudflare and the origin web server fails.
Halkali merkez neighborhood fatih st ozgur apt no 46 , Kucukcekmece , Istanbul , 34303 , TR
Cloudflare 525 SSL Handshake Failed: diagnose origin certificates, port 443, SNI, TLS/ciphers, web-server vhosts and intermittent failures.
Cloudflare 525 occurs when the SSL/TLS handshake between Cloudflare and the origin web server fails.
Cloudflare documents this error for Full and Full (Strict) SSL/TLS modes.
Documented causes include no valid SSL certificate at the origin, a closed secure port, missing SNI support and cipher mismatch.
With proxied HTTPS there are two TLS sessions: visitor-to-Cloudflare edge and Cloudflare-to-origin. A 525 happens on the second leg. Replacing the browser-facing edge certificate alone does not fix it.
This separates 525 from edge-certificate problems such as ERR_SSL_VERSION_OR_CIPHER_MISMATCH. For 525, prove that the origin speaks TLS, returns the correct SNI certificate and shares a supported TLS/cipher set with Cloudflare.
Verify which process is listening on port 443 at the origin. Nginx/Apache may not have restarted, a container port may not be published, or the reverse proxy may only listen on port 80.
An open firewall rule does not help if no service is listening. Conversely, if the service listens but Cloudflare source IP ranges are blocked, the connection can still fail before a successful handshake.
ss -lntp | grep ':443'curl -vk https://127.0.0.1/SNI matters when several HTTPS virtual hosts share one IP. Use `openssl s_client -connect ORIGIN_IP:443 -servername example.com` to see the certificate chain for the intended hostname. Testing without SNI may return the default vhost certificate and mislead diagnosis.
Certificate presence alone is insufficient; private-key matching, intermediate chain delivery and virtual-host selection matter. A wrong server_name or certificate path can produce unexpected handshake behavior.
openssl s_client -connect ORIGIN_IP:443 -servername example.com -showcertsFull encrypts the Cloudflare-to-origin leg but validates the origin certificate less strictly than Full (Strict). Full (Strict) expects a valid certificate covering the hostname. For production, Full (Strict) is the preferred security target.
525 is a handshake-level failure; 526 is more directly tied to origin-certificate validation under Full (Strict). Distinguishing the code prevents unnecessary certificate changes.
If the origin is restricted to obsolete TLS/ciphers or an excessively narrow cipher list, it may share no usable parameters with Cloudflare. A TLS-inspecting appliance can also fail before the web server is reached.
Read the web-server TLS configuration together with OpenSSL output. Do not weaken the entire cipher policy merely because a 525 appears; identify the actual mismatch first.
nginx -T 2>&1 | grep -E 'ssl_protocols|ssl_ciphers|server_name|ssl_certificate'apachectl -SCloudflare recommends inspecting origin SSL logs and Origin Analytics for intermittent 525s. If only some requests fail, look beyond a static certificate issue toward TLS-terminator capacity, a load-balancer node or backend differences.
Correlate Nginx, Apache, HAProxy or Traefik logs with the Cloudflare failure timestamp. Handshake timeout, no shared cipher, bad key share or connection reset messages point to different root causes.
tail -n 200 /var/log/nginx/error.logRather than disabling Cloudflare globally, use a controlled test. `curl --resolve example.com:443:ORIGIN_IP https://example.com/ -vk` bypasses DNS while preserving hostname/SNI, making it useful for testing the actual origin vhost.
If that test also fails, the origin TLS layer is the primary suspect. If it succeeds directly but Cloudflare still gets 525, investigate Cloudflare source access, SNI/cipher behavior and intermediary security devices.
curl --resolve example.com:443:ORIGIN_IP https://example.com/ -vk| Finding | Priority |
|---|---|
| Nothing listens on 443 | Nginx/Apache/container port |
| OpenSSL returns wrong certificate | SNI/vhost/server_name |
| Direct origin succeeds, Cloudflare gets 525 | Firewall, Cloudflare source access, TLS policy |
| Only some requests get 525 | Load balancer/TLS terminator capacity and node differences |
Before production changes, verify context and keep backups and a rollback plan. Do not change several DNS, TLS, recovery, Docker or WordPress variables at once because it obscures the root cause.
525 is an SSL/TLS handshake failure; 526 is tied to origin-certificate validation under Full (Strict).
It may hide the error because Cloudflare connects to the origin over HTTP, but it removes origin encryption and is not a secure permanent fix.
Certificate presence alone is insufficient; wrong SNI/vhost, closed 443, key/chain problems or TLS/cipher mismatch can still break the handshake.
If the problem persists in hosting, VPS, Docker, Cloudflare, Windows or WordPress infrastructure, open a technical support request with the exact error output and current architecture.