What Causes Cloudflare Error 526?
When your Cloudflare SSL/TLS encryption mode is set to Full (Strict), Cloudflare requires your origin web server to present an SSL certificate that is:
- Issued by a publicly trusted CA (like Let's Encrypt or DigiCert) OR a free Cloudflare Origin CA certificate.
- Unexpired (valid dates).
- Matching the exact domain name requested in Subject Alternative Names (SANs).
If your origin certificate expires, Error 526 is displayed immediately to all visitors.
How to Fix Error 526
- Option A: Install a Free Cloudflare Origin CA Certificate (Recommended): In the Cloudflare Dashboard, go to SSL/TLS > Origin Server > Create Certificate. Install the 15-year Origin CA certificate on your origin server.
- Option B: Renew Your Origin Let's Encrypt Certificate:
Run
sudo certbot renew --force-renewalon your origin server and reload Nginx/Apache.
⚡ Never Let Your Origin Certificate Expire
Set up automated 24/7 expiry alerts for all your origin domains.
Monitor Certificate Expiry →