Diagnosing Cloudflare error 526 with Full strict TLS

Record the hostname, origin destination, Ray ID and time. Check whether a recent migration, renewal or certificate installation changed the origin configuration.

1. Confirm Cloudflare routes to the intended server and that its HTTPS virtual host serves the correct certificate for this hostname.
2. Inspect the certificate’s validity dates, hostname coverage, issuer and intermediate chain. Test with SNI rather than only the raw IP address.
3. Install or renew an appropriate publicly trusted certificate, or use a suitable Cloudflare Origin CA certificate for a proxy-only origin.
4. Reload the supported web-server configuration if required and verify the origin is presenting the replacement rather than an old default certificate.
5. Retest through Cloudflare with Full (strict) and check every origin or alternate hostname involved in routing.

The strict connection should succeed without a validation error. Keep renewal monitoring active so the fix remains effective beyond the current certificate’s lifetime.

A self-signed certificate is not automatically trusted by strict mode. Temporarily removing validation does not repair the underlying certificate, and an Origin CA certificate will not become publicly trusted when the proxy is paused. Choose the correct certificate for the intended access path.

Shared servers select certificates by hostname. One domain can have valid coverage while another uses an expired, mismatched or incomplete certificate configuration.

• Installing a Cloudflare Origin CA certificate and understanding its trust
• Diagnosing Cloudflare error 525 during the origin TLS handshake
• Changing the hosting origin behind an existing Cloudflare proxy
• Moving a Cloudflare site to Full strict TLS safely

• Cloudflare: Error 526
• Cloudflare: Full Strict