SteadyNode

Cloudflare · HTTP 525

Cloudflare Error 525: SSL Handshake Failed

Troubleshoot Cloudflare 525 between the edge and origin. Check TLS protocol support, SNI, certificate presentation, and handshake logs on the origin.

Origin / TLS Configuration

Decode a CDN or gateway error

Paste a captured HTTP response or enter a status and headers. Only the status and response headers are sent; common credential headers are filtered first.

Supports raw headers, full HTTP responses, JSON with status/statusCode and headers, cURL -v/-i response output, and HAR exports. HAR selects a server error first. cURL commands are never executed; request headers, response bodies, and common credential headers are excluded.

Diagnostic report

Error code / name

CF-525

Fault domain

Origin / TLS Configuration

Why it happened

The edge reached the origin but could not complete TLS negotiation. Protocol or cipher incompatibility, an incorrect SNI virtual host, or a server-side handshake failure can stop the connection before HTTP begins.

Actionable fixes

  1. Inspect origin TLS logs for the SNI name and negotiated protocol at the CF-Ray timestamp.
  2. Confirm the origin serves a certificate for the requested hostname and supports current TLS versions.
  3. Test the origin handshake directly without disabling certificate verification.

Why this error happened

The edge reached the origin but could not complete TLS negotiation. Protocol or cipher incompatibility, an incorrect SNI virtual host, or a server-side handshake failure can stop the connection before HTTP begins.

Actionable fixes

  1. Inspect origin TLS logs for the SNI name and negotiated protocol at the CF-Ray timestamp.
  2. Confirm the origin serves a certificate for the requested hostname and supports current TLS versions.
  3. Test the origin handshake directly without disabling certificate verification.

Network failure point

Client -> Cloudflare Edge -> TLS OK -> ClientHello/SNI -> Origin TLS negotiation fails -> X

Verify origin directly via CLI

openssl s_client -connect ORIGIN_IP:443 -servername example.com -verify_return_error -showcerts </dev/null

Configuration fix

nginx.confnginx
server {
    listen 443 ssl;
    server_name example.com;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_certificate /etc/ssl/example/fullchain.pem;
    ssl_certificate_key /etc/ssl/example/privkey.pem;
}

Catch this failure before it becomes an outage

SteadyNode's TLS Chain Debugger checks the public certificate chain and protocol negotiation, while regional HTTP checks distinguish TLS failures from application outages.

No credit card required.

Start for free

Frequently asked questions

Does Cloudflare 525 mean the visitor's TLS failed?

No. It usually identifies a failed TLS handshake between Cloudflare and the configured origin.

Can a missing intermediate certificate cause 525?

It can. Configure the origin to serve the leaf certificate and every required intermediate in the correct chain.

More CDN and gateway error guides

Cloudflare

Vercel and Netlify

AWS CloudFront and ALB

Fastly

Heroku and Render

Nginx and Envoy