Introduction
Error 526 is an HTTPS error that happens when the website cannot establish a secure connection, indicating a failed or incomplete SSL handshake. It shows that the SSL certificate on the origin server is invalid, expired, self-signed, not configured correctly, or the certificate was issued by an untrusted Certificate Authority (CA).
In this article, you will learn how to fix the 526 Invalid SSL certificate error.
What Is Error 526?
Error 526 is an SSL certificate error that occurs when Cloudflare cannot verify the SSL certificate presented by the origin server. In case the SSL certificate is invalid, web browsers display a warning message that the website is vulnerable to attacks.
The 526 HTTP response status code is an unofficial server error specific to Cloudflare.
What Causes Error 526 Invalid SSL Certificate?
Error 526 occurs when the origin server's SSL certificate fails to establish a secure connection. Common causes of the 526 Cloudflare error are:
- Full (strict) SSL mode on Cloudflare. The Full (strict) mode of Cloudflare's SSL/TLS encryption may cause the 526 error. Moreover, the Full (Strict) mode does not allow unsecured data exchange between Cloudflare servers and the origin server.
- Incorrect SSL certificate installation. If the SSL certificate is not installed correctly, the visitor's browser fails to recognize it, resulting in error 526.
- SSL certificate not issued by a trusted CA. If the SSL certificate is not issued by a trusted CA, the visitor's browser does not recognize it as a valid certificate.
- Expired SSL certificate. SSL certificates have a validity period. Once it expires, the certificate becomes invalid.
- Self-signed SSL certificate. Self-signed SSL certificates are not issued by a trusted CA and are not trusted by browsers by default.
- Domain name mismatch. If the SSL certificate domain name does not match the website's domain name, the visitor's browser does not recognize it as valid.
- SSL/TLS protocol mismatch. If the SSL/TLS protocol used by the website does not match the protocol supported by the visitor's browser, the site visitor gets the 526 invalid certificate error.
How To Fix Cloudflare Error 526 Invalid SSL Certificate?
Depending on the root cause of the issue, there are half a dozen ways to fix Cloudflare's error 526. The following sections outline how to identify what's causing the issue and how to fix it.
Method 1: Switch SSL Mode from Full (strict) to Full
Cloudflare offers four SSL modes: Off, Flexible, Full, and Full (Strict). In Full (strict) mode, Cloudflare requires a valid SSL certificate on the origin server. It also verifies the certificate's hostname against the hostname the browser connects to. In case of any mismatch, Cloudflare returns HTTP status 526 to the browser.
The first thing to do is change the SSL mode from Full (strict) to Full. The Full mode requires an SSL certificate on the origin server, but it does not perform hostname verification.
Follow the steps below to change Cloudflare's SSL mode from Full (strict) to Full:
1. Log in to your Cloudflare account.
2. Select the domain to change the SSL mode.
3. Navigate to the SSL/TLS tab.
4. Under the Overview tab, look for the Encryption settings.
5. If the Full (strict) mode is selected, change it to Full.
After switching the SSL mode to Full, wait a few minutes and try accessing the website again. If the error persists, try the other methods listed below.
Method 2: Check the SSL Certificate
When an SSL certificate is not installed correctly, it results in a 526 error. Check the SSL certificate installation status by logging into your web hosting account or server. Depending on the hosting provider and the type of hosting plan, access the account following one of these methods:
- Access the account using a web-based control panel like cPanel, DirectAdmin, Webmin, or Plesk.
- Use a remote desktop application like PuTTY, Remote Desktop Connection (for Windows), or VNC Viewer to connect to the server if you have a VPS or dedicated server.
Once logged in, take the following steps to verify the SSL certificate:
1. Locate the SSL/TLS settings in the web hosting control panel or server configuration settings. Look for an option that says SSL/TLS or Security. For instance, cPanel SSL/TLS settings look like this:
2. If the installation status is incomplete or shows errors, reinstall the certificate. The steps vary depending on the provider, but the certificate installation options are often in the same SSL/TLS panel.
Method 3: Check for a Domain Name Mismatch
A possible cause of the Cloudflare 526 error is an SSL certificate that was issued for the wrong or misspelled domain name. Log into your web hosting account or server and check the domain name associated with the SSL certificate.
1. Locate the SSL/TLS settings.
2. Check the domain name on the SSL certificate by looking for an option that displays the SSL certificate's information.
3. Verify that the domain name on the certificate matches the website's domain name.
Note: Steps vary depending on the hosting provider.
4. If the domain name is incorrect, contact the SSL certificate provider to fix it.
Method 4: Use a Trusted SSL Certificate
Purchase SSL certificates issued by a trusted Certificate Authority (CA) to ensure most visitors' browsers recognize the origin server's certificate.
Note: Using an SSL certificate from a trusted CA prevents errors and assures users that the website is authentic and safe. On the other hand, SSL certificates from untrusted CAs cause issues and are a warning sign to site visitors to leave the page immediately.
Check the list of trusted Certificate Authorities in your local browser's settings or preferences. For example, in Chrome:
1. Open the Customize and Control Google Chrome drop-down and select Settings > Privacy and security.
2. Click Security.
3. Scroll down and click Manage device certificates under the Advanced section:
If the certificate is on the list, it is trusted by the CA. The process is similar for other browsers.
Another way to check whether the origin server has a certificate from a trusted CA is by using the curl command. For instance, run curl -v on phoenixnap.com:
curl -v https://www.phoenixnap.com
This command prints SSL certificate details at the bottom, such as the expiration date, domain name, and issuer. The output ends with the note: SSL certificate verify ok.
Alternatively, use curl -I:
curl -I https://www.phoenixnap.com
The output is extensive, and no error warnings indicate that it is a self-signed certificate. Moreover, the Strict-Transport-Security header indicates that the website uses HTTPS with HSTS (HTTP Strict Transport Security). This header only works on a server that uses a valid SSL certificate issued by a trusted CA.
However, when curl -v is used to check a domain with an untrusted certificate, the commands print error messages. For example:
curl -v https://untrusted-cert-example.com
When the origins server's certificate is not trusted, curl -v prints a warning message along with other data. The output states the specific reason the certificate is not trusted. In this example, the error message states that the SSL certificate problem exists because curl is unable to get the local issuer certificate. The certificate is considered invalid and leads to error 526.
The curl -I command gives a similar output for the same domain:
curl -I https://untrusted-cert-example.com
Note: Both curl -v and curl -I print the SSL certificate details useful for dealing with a 526 error. The difference is that curl -v provides more verbose output explaining the error, while curl -I only displays the error code without additional details.
If your domain's SSL certificate was no issued by a trusted CA, follow the steps below to fix the issue:
1. Purchase an SSL certificate from a trusted CA, via a reputable web hosting provider or third-party vendor. While more expensive, these certificates provide greater security and are recognized by all major browsers.
2. Install the certificate on the website.
3. Reuse the curl -v command to verify the certificate is trusted.
Method 5: Renew SSL Certificate if Expired
A 526 error on the website sometimes indicates that the SSL certificate has expired. To check whether that is the case, run curl. For instance, verify whether the following website has an expired certificate with curl -I (curl -v also works):
curl -I https://expired-cert-example.com
If the output shows that the certificate has expired:
1. Renew the SSL certificate based on the instructions on the certificate provider’s website.
2. Install the certificate on the website. The specific steps to do this vary depending on the hosting provider and server setup.
3. Run curl -I or curl -v to verify the renewed SSL certificate is installed correctly.
Note: Some hosting providers offer automatic renewal and installation of SSL certificates.
Method 6: Avoid Self-Signed SSL Certificates
Most web browsers do not trust self-signed SSL certificates. A self-signed SSL certificate is signed by the same entity that issued it instead of being signed by a trusted third-party Certificate Authority (CA).
When a visitor tries to access a website with a self-signed certificate, the browser shows a warning message indicating that the website is not secure.
Certain browsers even prevent visitors from accessing the website altogether. In certain cases, self-signed certificates cause SSL handshake errors and other SSL-related issues, which leads to Cloudflare's error 526.
To check whether the origin server uses a self-signed certificate, run curl with the -v argument:
curl -v https://www.bad-cert-example.com
The output prints a message indicating that the certificate is self-signed. Alternatively, run curl -I to get the error message without the details:
curl -I https://www.bad-cert-example.com
To resolve the issue, the site owner must obtain and install an SSL certificate from a trusted CA.
3. Use curl -v to verify the certificate is trusted.
Method 7: Check SSL/TLS Protocol
When a visitor tries to access a website, the browser and the website's server communicate using a specific SSL/TLS protocol. However, if the SSL/TLS protocol used by the website does not match the protocol supported by the visitor's browser, error 526 occurs.
To check the SSL/TLS protocol used by the website and ensure it matches the protocol supported by the visitor's browser, follow these steps:
1. Log in to your web hosting account or server.
2. Navigate to the SSL/TLS settings section. The location of this section depends on the hosting provider and the type of hosting plan.
3. Check the SSL/TLS protocol used by the website.
4. Check the protocol supported by the visitor's browser. For example, look up the protocol supported by a particular browser online or by review the browser documentation.
5. If the protocols do not match, update the SSL/TLS protocol to one supported by the visitor's browser.
Save the changes and verify if error 526 has been resolved by recessing the website.
Conclusion
After reading this article, you now know how to fix Cloudflare's error 526. If you are experiencing other issues with Cloudflare, check our articles on how to fix various Cloudflare errors.
