Cloudflare error 525 means its TLS handshake with the origin failed. The browser may already have a valid connection to Cloudflare, so focus on the origin’s secure listener and handshake evidence.
IN THIS ARTICLE
Gather the details you will need
Record the failing hostname, URL, UTC time and Ray ID. Confirm the configured origin address and whether the error affects every request or only some servers or moments.
01 Diagnose Cloudflare error 525 during the origin TLS handshake
- Check that the origin web server is running and accepts HTTPS on the configured secure port.
- Verify a certificate and matching private key are installed for the requested hostname, with SNI support and compatible TLS settings.
- Ask the provider to test the origin with the real hostname and inspect SSL error logs at the recorded time. A bare-IP browser test can select the wrong virtual host.
- Review firewall or connection limits that could reset Cloudflare’s handshake, including intermittent resource exhaustion.
- Correct the identified listener, certificate or TLS problem and repeat the public request under the intended Full (strict) configuration.
Confirm the expected result
The origin should complete the handshake consistently and serve the application through Cloudflare. Test several requests if the failure was intermittent.
If the problem continues
Distinguish 525 from 526, which specifically concerns origin certificate validation under strict mode. Do not erase log evidence or weaken all server cipher settings without identifying the compatibility issue. Shared-hosting customers should provide the diagnostic details to support.
Will clearing the CDN cache fix a TLS handshake?
No. Cache purging does not repair the origin’s TLS listener or negotiation. It may increase origin requests, so resolve the connection problem first.
.png)
 (1).jpg)
 (1) (1).png)
 (1).png)
.jpg)
.jpg)
 (1).jpg)
.jpg)
