Cloudflare, failing TLS with the origin.
Cloudflare error 525 — SSL handshake failed
Cloudflare could not complete a TLS handshake with the origin server. This is a certificate or cipher mismatch behind the CDN, entirely separate from your own TLS to Cloudflare.
A proxy does not fix this. This is the clearest example of an error where buying proxies is the wrong answer. The handshake that failed is between Cloudflare and the site, and your client is not part of it.
Why it happens
The origin certificate expired, or does not cover the hostname.
The origin and Cloudflare share no cipher suite — usually an origin too old or configured too strictly.
Full (strict) SSL mode enabled against an origin with a self-signed certificate.
How to fix it
- Nothing, from the client side. Report it to the site if you have a channel.
- Confirm it reproduces without a proxy so you do not spend an afternoon on your own configuration.
FAQ
What does 525 mean?›
Cloudflare could not complete a TLS handshake with the origin server. This is a certificate or cipher mismatch behind the CDN, entirely separate from your own TLS to Cloudflare. Cloudflare, failing TLS with the origin.
Why am I getting 525?›
The origin certificate expired, or does not cover the hostname. The origin and Cloudflare share no cipher suite — usually an origin too old or configured too strictly. Full (strict) SSL mode enabled against an origin with a self-signed certificate.
How do I fix 525?›
Nothing, from the client side. Report it to the site if you have a channel. Confirm it reproduces without a proxy so you do not spend an afternoon on your own configuration.
Will a proxy fix 525?›
This is the clearest example of an error where buying proxies is the wrong answer. The handshake that failed is between Cloudflare and the site, and your client is not part of it.