# Error 525: SSL handshake failed

- **ID:** `policy/cloudflare-ssl-tls-mismatch`
- **Domain:** policy
- **Category:** network_error
- **Error Code:** `525`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

Cloudflare's SSL/TLS setting (e.g., Full or Full (strict)) requires a valid certificate on the origin server; mismatched or self-signed certificates cause handshake failure.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Cloudflare (2024-02) | active | — | — |
| Nginx 1.24 | active | — | — |

## Workarounds

1. **Install a valid SSL certificate on the origin server (e.g., using Let's Encrypt: `sudo certbot --nginx -d example.com`) and set Cloudflare SSL/TLS to 'Full (strict)'.** (95% success)
   ```
   Install a valid SSL certificate on the origin server (e.g., using Let's Encrypt: `sudo certbot --nginx -d example.com`) and set Cloudflare SSL/TLS to 'Full (strict)'.
   ```
2. **Temporarily set Cloudflare SSL/TLS to 'Flexible' to bypass the handshake, then fix the origin certificate.** (85% success)
   ```
   Temporarily set Cloudflare SSL/TLS to 'Flexible' to bypass the handshake, then fix the origin certificate.
   ```

## Dead Ends

- **** — This exposes traffic to man-in-the-middle attacks and may break HTTPS-only features. (80% fail)
- **** — The issue may be an incomplete chain or unsupported cipher, not expiration. (60% fail)
- **** — This bypasses the error but leaves traffic unencrypted between Cloudflare and origin. (70% fail)