Cloudflare Error 525 (SSL Handshake Failed): Root Causes and Step-by-Step Fixes

What is Cloudflare Error 525?

When you use Cloudflare in Full or Full (Strict) encryption mode, two separate SSL handshakes take place:

1. Visitor ➔ Cloudflare Edge: Encrypted using Cloudflare Universal SSL.
2. Cloudflare Edge ➔ Origin Server: Encrypted using your origin server's SSL certificate on port 443.

If the connection between Cloudflare and your origin server fails during the TLS handshake, Cloudflare displays Error 525: SSL Handshake Failed to visitors.

5 Most Common Root Causes and Fixes

1. Origin Server Not Listening on Port 443: Verify your origin server has an active SSL VirtualHost on port 443.
2. Origin Cipher Suite Incompatible: Cloudflare edge servers require modern ciphers (e.g. ECDHE).
3. Missing SNI on Origin: If your origin hosts multiple domains, ensure your web server properly handles SNI for the requested hostname.
4. Origin Firewall Blocking Cloudflare IPs: Ensure your origin server's firewall (ufw, iptables, AWS Security Groups) allows all Cloudflare IP ranges on port 443.