HTTP 526 Invalid SSL Certificate — Reverse Proxy & Gateway Troubleshooting
Error 526 Invalid SSL Certificate means Cloudflare is configured in Full (Strict) SSL mode and rejected your origin server's X.509 certificate because it is expired, self-signed, untrusted, or missing the requested hostname in its Subject Alternative Name (SAN) list.
| Status Code | 526 Invalid SSL Certificate |
|---|---|
| Specification / Origin | Cloudflare Edge Code 526 |
| Failure Layer | Origin X.509 Certificate Validation |
| Retry Safety | Do not blind-retry without fixing request syntax, auth, or origin certificate |
Interactive HTTP 526 Live Probe & Log Command Builder
Enter your target endpoint below to generate copy-ready curl latency breakdown probes and origin bypass tests:
Related diagnostics: Nginx & Caddy Proxy Generator → · X.509 SSL Certificate Decoder → · Offline JWT Expiry Inspector →
Production Root Causes & Remediation Guide
Happens when Let's Encrypt Certbot systemd timers silently fail renewal (NotAfter passed), when Nginx serves fullchain.pem missing intermediate CA certificates (cert.pem used by mistake), or when a newly added subdomain isn't covered by the origin SAN.
Step-by-Step Engineering Fix
Decode your origin PEM certificate locally to verify NotAfter expiry and DNS: SAN entries, ensure Nginx ssl_certificate points to fullchain.pem (not bare cert.pem), or install a 15-year Cloudflare Origin CA certificate.
Recommended Nginx / Reverse-Proxy Configuration Snippet
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
Frequently Asked Questions (HTTP 526)
Why does Full (Strict) fail with 526 when cert.pem isn't expired?
Pointing Nginx ssl_certificate to cert.pem instead of fullchain.pem omits the intermediate CA certificate required to validate the trust chain.
Which infrastructure layer generates HTTP 526 Invalid SSL Certificate?
HTTP 526 (Cloudflare Edge Code 526) typically originates at the Origin X.509 Certificate Validation layer. Error 526 Invalid SSL Certificate means Cloudflare is configured in Full (Strict) SSL mode and rejected your origin server's X.509 certificate because it is expired, self-signed, untrusted, or missing the requested hostname in its Subject Alternative Name (SAN) list.
Should API clients automatically retry HTTP 526 responses?
Do not blind-retry HTTP 526 without fixing the underlying request payload, authentication token, or origin TLS certificate first.
Browse All 25 Gateway, Proxy & Cloud HTTP Error Guides
HTTP 400 (Bad Request) HTTP 401 (Unauthorized) HTTP 403 (Forbidden) HTTP 404 (Not Found) HTTP 405 (Method Not Allowed) HTTP 408 (Request Timeout) HTTP 413 (Content Too Large) HTTP 422 (Unprocessable Content) HTTP 429 (Too Many Requests) HTTP 431 (Request Header Fields Too Large) HTTP 499 (Client Closed Request) HTTP 500 (Internal Server Error) HTTP 501 (Not Implemented) HTTP 502 (Bad Gateway) HTTP 503 (Service Unavailable) HTTP 504 (Gateway Timeout) HTTP 507 (Insufficient Storage) HTTP 511 (Network Authentication Required) HTTP 520 (Web Server Returned an Unknown Error) HTTP 521 (Web Server Is Down) HTTP 522 (Connection Timed Out) HTTP 523 (Origin Is Unreachable) HTTP 524 (A Timeout Occurred) HTTP 525 (SSL Handshake Failed) HTTP 526 (Invalid SSL Certificate)