# 错误525：SSL握手失败

- **ID:** `policy/cloudflare-ssl-tls-mismatch`
- **领域:** policy
- **类别:** network_error
- **错误码:** `525`
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

Cloudflare的SSL/TLS设置（例如完全或完全（严格））要求源服务器上有有效的证书；不匹配或自签名证书会导致握手失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Cloudflare (2024-02) | active | — | — |
| Nginx 1.24 | active | — | — |

## 解决方案

1. ```
   Install a valid SSL certificate on the origin server (e.g., using Let's Encrypt: `sudo certbot --nginx -d example.com`) and set Cloudflare SSL/TLS to 'Full (strict)'.
   ```
2. ```
   Temporarily set Cloudflare SSL/TLS to 'Flexible' to bypass the handshake, then fix the origin certificate.
   ```

## 无效尝试

- **** — This exposes traffic to man-in-the-middle attacks and may break HTTPS-only features. (80% 失败率)
- **** — The issue may be an incomplete chain or unsupported cipher, not expiration. (60% 失败率)
- **** — This bypasses the error but leaves traffic unencrypted between Cloudflare and origin. (70% 失败率)