SSL mode Full (strict) without breaking things

Origin certificates, and what causes 525 and 526

Full (strict) means Cloudflare verifies your origin’s certificate like a browser would. It is the only mode that actually encrypts the whole path safely — and the mode that produces 525/526 when the origin side is wrong.

Get a certificate the origin can present

Use a free Cloudflare Origin CA certificate (valid up to 15 years, trusted only by Cloudflare) or a public certificate from Let’s Encrypt. Install it on the origin with the full chain.

SNI and ports

The origin must serve TLS on 443 and support SNI for the hostname Cloudflare requests. A 525 usually means no TLS on 443, no SNI, or no shared cipher; a 526 means the certificate did not validate — expired, wrong name, or self-signed.

Switch in the right order

Install and test the origin certificate first (curl --resolve against the origin IP), then flip the SSL mode to Full (strict). Doing it the other way round takes the site down for the duration.

Renewals

Let’s Encrypt certificates renew every 60–90 days; automate it and alert on failure. An expired origin certificate is the most common 526.

All guides