525 policy network_error ai_generated true

Error 525: SSL handshake failed

ID: policy/cloudflare-ssl-tls-mismatch

Also available as: JSON · Markdown · 中文
90%Fix Rate
84%Confidence
1Evidence
2024-01-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Cloudflare (2024-02) active — — —
Nginx 1.24 active — — —

Root Cause

Cloudflare's SSL/TLS setting (e.g., Full or Full (strict)) requires a valid certificate on the origin server; mismatched or self-signed certificates cause handshake failure.

generic

中文

Cloudflare的SSL/TLS设置（例如完全或完全（严格））要求源服务器上有有效的证书；不匹配或自签名证书会导致握手失败。

Official Documentation

https://developers.cloudflare.com/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-5xx-errors/#error-525-ssl-handshake-failed

Workarounds

  1. 95% success Install a valid SSL certificate on the origin server (e.g., using Let's Encrypt: `sudo certbot --nginx -d example.com`) and set Cloudflare SSL/TLS to 'Full (strict)'. 
    Install a valid SSL certificate on the origin server (e.g., using Let's Encrypt: `sudo certbot --nginx -d example.com`) and set Cloudflare SSL/TLS to 'Full (strict)'.
  2. 85% success Temporarily set Cloudflare SSL/TLS to 'Flexible' to bypass the handshake, then fix the origin certificate. 
    Temporarily set Cloudflare SSL/TLS to 'Flexible' to bypass the handshake, then fix the origin certificate.

中文步骤

  1. Install a valid SSL certificate on the origin server (e.g., using Let's Encrypt: `sudo certbot --nginx -d example.com`) and set Cloudflare SSL/TLS to 'Full (strict)'.
  2. Temporarily set Cloudflare SSL/TLS to 'Flexible' to bypass the handshake, then fix the origin certificate.

Dead Ends

Common approaches that don't work:

  1. 80% fail

    This exposes traffic to man-in-the-middle attacks and may break HTTPS-only features.

  2. 60% fail

    The issue may be an incomplete chain or unsupported cipher, not expiration.

  3. 70% fail

    This bypasses the error but leaves traffic unencrypted between Cloudflare and origin.