Japan Server Error Fix Lab

Home / Cloudflare / Cloudflare

Cloudflare SSL 525 handshake failed

A common SSL error caused by a failed TLS connection between Cloudflare and the origin server.

high5258 min read
First command
curl -Iv https://example.com --resolve example.com:443:ORIGIN_IP
First evidence

For Cloudflare 525, first collect timestamp, request URL, affected user, latest change, and the first matching log line.

Search queries
Cloudflare 525Cloudflare error 525Cloudflare SSL 525 handshake failed

When this happens

This often appears after enabling the Cloudflare proxy: the site shows 525 while the origin server is still alive. The issue is usually not plain DNS, but certificate, SNI, TLS version, or virtual host mismatch during Cloudflare-to-origin TLS.

Symptom checklist

  • Browser shows Error 525.
  • Cloudflare events record SSL handshake failed.
  • Direct origin IP access shows a certificate warning or another TLS error.
  • Switching to DNS only may open the page or change the error code.
  • Other domains on the same server may work while one hostname fails.

Likely causes

  • Origin certificate is expired or does not match the hostname.
  • Cloudflare SSL mode is Full strict while the intermediate chain is missing.
  • Nginx or Apache does not return the certificate matching SNI.
  • The origin does not support TLS 1.2+ or Cloudflare-accepted ciphers.
  • Virtual host server_name, ServerName, or ssl_certificate paths do not match the real domain.
  • TLS is terminated again behind ALB or another reverse proxy with a mismatched certificate.

First 1-minute checks

  1. Temporarily switch Cloudflare SSL mode from Full strict to Full and compare symptoms.
  2. Run curl and openssl against the origin IP with SNI.
  3. Check which certificate Nginx or Apache virtual host returns.
  4. Confirm origin TLS versions and cipher settings.

First evidence

For Cloudflare 525, first collect timestamp, request URL, affected user, latest change, and the first matching log line.

Output examples

Normal output

curl -Iv https://example.com --resolve example.com:443:ORIGIN_IP
# no matching 525 entries during the checked window

Failing output

curl -Iv https://example.com --resolve example.com:443:ORIGIN_IP
# 525 appears with timestamp, request path, user, and upstream layer

Output-to-action branches

  • No matching error appears at the same time.
    Start outside the origin: browser, CDN, proxy, DNS cache, or client network.
  • The same timestamp and path appear in logs.
    Inspect the service, upstream, permission, or data state that produced that log line.
  • Working and failing users get different output.
    Compare permissions, session state, network location, and cache state.

Do not do this

  • Do not change multiple settings from the visible code alone.
  • Do not start with global cache purge, broad permission grants, or disabled security controls before identifying the failing layer.

Evidence quality

Operator draft: includes baseline output examples and branches. Real incident output and official-source links continue through the update queue.

Commands to run first

curl -Iv https://example.com --resolve example.com:443:ORIGIN_IP
openssl s_client -connect ORIGIN_IP:443 -servername example.com -showcerts
nginx -T | grep -n "server_name\|ssl_certificate"
apachectl -S
nmap --script ssl-enum-ciphers -p 443 example.com

Fix order

  1. Check origin certificate expiry and hostname match.
  2. Confirm whether Cloudflare SSL mode is Flexible, Full, or Full strict.
  3. Use openssl with SNI to inspect the actual returned certificate.
  4. Review Nginx/Apache virtual host settings by domain.
  5. After fixing, purge Cloudflare cache and re-run the same commands.

Actions by cause

  • Renew the origin certificate and use a full chain file.
  • Align Nginx server_name and ssl_certificate, or Apache ServerName and SSLCertificateFile, with the real domain.
  • If using Cloudflare Origin Certificate, separate the fact that direct non-proxied access may not trust it.
  • Allow TLS 1.2+ and remove outdated ciphers.
  • If behind ALB, check both ALB listener certificate and backend certificate policy.

Verification metadata

  • operator-draft
  • official-reference-linked
  • 2026-07-23

Update queue

  • Review cadence
    weekly-source-review
  • Next enrichment
    Add one official-source check and one real output example for Cloudflare 525.

Environment-specific checks

  • For Japanese hosting such as Xserver, ConoHa, or CPI, first confirm SSL completion in the control panel.
  • Behind AWS ALB, check listener certificate, target group health, and backend port together.
  • Record the result after turning Cloudflare proxy off to DNS only.
  • After Let’s Encrypt renewal, confirm the web server was reloaded.
  • When multiple domains share one server, verify certificate selection by SNI.

Prevent it next time

  • Configure certificate expiry alerts 30 days in advance.
  • Add curl and openssl checks to the post-deploy checklist.
  • Document Cloudflare SSL mode and origin certificate policy.
  • Test Nginx/Apache virtual host changes on a test domain first.
  • Avoid doing DNS, proxy, and certificate changes all on the same day.